- grok tests now pass under event v1
- Added 'overwrite' setting to allow %{FOO:message} to overwite
  'message' field (or any other field.