Parse log using logstash and make ecs format

The ecs-mapper tool does not appear to understand that mutate does things in a fixed order, so that example output will not work.

copy => { '[destport]' => '[destination][port]' }
convert => { '[destination][port]' => 'integer' }

convert is executed before copy. That's why using rename is good, it gets done early.