Copy over the user_agent for httpd_json logs
Capture tags

Logstash-forwarder doesn't support arrays, so we have to split them
ourselves.
Parse logs from logstash-forwarder

How ironic.
All timezones are UTC
Match on correct field name

msg's already been renamed to message.
Test on tag for es output no longer relevant
grep filter deprecated in 1.2
Reorganize parsed user-agent

Put it all into one object.
Normalize host/hostname for bunyan type
Provide geojson point for Kibana bettermap panel