- standardize of a few field names:
  * host: the origin of the event (for file input, etc, many times this is
    obvious. For network inputs, this is often the client ip address)
  * path: the origin path of the event (file path, EventLog source, etc)
- some misc style cleanup done while doing the above.