filters: elasticsearch: new filter for querying es

Sometimes it's useful to be able to correlate new events with previous
events (e.g., to calculate time duration between events).  This filter
queries an elasticsearch host to find the top event matching the given
search criteria and copies specific fields from that event into the new
event.

Here's an example that will determine when an operation started and
store that timestamp into the ending event:

   if [type] == "end" {
      elasticsearch {
         hosts => ["es-server"]
         query => "type:start AND operation:%{[opid]}"
         fields => ["@timestamp", "started"]
      }

      date {
         match => ["[started]", "ISO8601"]
         target => "[started]"
      }
   }
inputs: pipe: rerun command when it terminates

This change causes the pipe input to keep rerunning the command.
Without this change, if the command crashes or simply stops sending
output for some unknown reason, then logging effectively stops.  Also,
it introduces a short delay before restarting the command to avoid
churning on a failing command.