Update tutorials for logstash 1.2.x
an edge case
Use 'message' as the default field
- add tests to cover grok singles with duplicate field names