Pull in BinData gem for parsing Netflow packets.
Add Netflow input plugin, currently supporting v5:

- A log event is created for each flow record in a received packet. @fields
  contains all of the fields in the flow records plus some of the ones found
  in the global header.

- @timestamp is taken from the epoch seconds/nanoseconds provided in the
  flowset header.

- IP address fields are converted from uint32 to dotted quad.

- First/Last switched records are converted from device uptime milliseconds
  into a UTC timestamp.
Require at least BinData 1.5.0 for needed functionality.
Add v9 support to Netflow input plugin:

- Implemented v9 fields 1-45, 56, 57, 80, 81.

- MAC address fields are converted to aa:bb:cc:dd:ee:ff form.

- Implement v5 pad fields with skip type.
Small typo.
Make some of the record fields less verbose.
Fix parsing options templates.

- Additionally, it seems the flow_records header field refers to the number
  of flow records across all flowsets, _not_ the number of flowsets so change
  the records array to read until EOF.
Explicitly handle field length defaults.

So it appears some devices just send a length of 0 for variable size fields
where the default is to be assumed, requiring the collector to hopefully
use the right value.
Fix options template parsing bug.

- Move the field building to a separate function so we can call it for
  option templates too.

- Implement v9 fields 46-55.
Add Netflow v9 fields 51 & 61.

Enough fields are now implemented to satisfy the Netflow sent from a Cisco
7200 router.
Add Netflow v9 fields 43, 58-60, 62-69.

Now there is 1-69, 80-83 implemented.
Correct field size for Netflow v9 field 48.

Despite spec setting the size as a single byte, testing on Cisco 7200
shows the size is set to 4 bytes. Allow source device to override the
default size and make the default size 4 instead of 1.

Discovered from http://www.rfc-editor.org/errata_search.php?rfc=3954
Improve checking of the template and record length.
Move Netflow fields to use "netflow." namespace.
Fix the timestamp formatting.
Re-jig Netflow input as a filter on top of the UDP input.

The original event is dropped, in it's place are zero or more events for each
Netflow record contained in the original event.
netflow filter: add compatibility with logstash 1.2.*
fixed broken merge
Merge pull request #580 from nikicat/netflow-filter-new

New: netflow filter