Rearrange type-specific filters into own files

The '200_filters_all.conf' was actually a container for filters
acting on 'syslog' and 'audit' type messages.

Split these into their own config files, and leave 200_filters_all
available for filters acting early (200) on all types.
Add a uuid in @logstash_uuid, use for ES doc id.

Set a UUID for each message, and make it the _id for each message fired
into ElasticSearch.

This in turn can be used to:

* Reload data into ES
* Multi-path messages, so overwrites of duplicates do not matter.

In the process, extract the elasticsearch flush_size parameter into a pillar
value, so we can play with tuning it. '1' is extremely inefficient.

WARNING:

This appears to add significant time to the tests and probably start-up
time of logstash -- this appears to be due to SecureRandom.uuid blocking
for a few minutes, I suspect due to entropy gathering.

The filter can be disabled by removal of '200_filter_all' from the pillar data.
Replace broken uuid filter with a ruby one-liner
Handle haproxy log messages via syslog
Allow specification of _spec.rb files to test