Add "emergency" to `LOGLEVEL` grok pattern

Apache, nginx, syslog, and many systems use emergency level, and it was missing in logstash.

Also add tests to cover all scenarios of `LOGLEVEL` expansion.