eve updates v0

Rebased #954, remove 'unknown' fields.

Prscript:
- PR build: https://buildbot.suricata-ids.org/builders/inliniac/builds/297
- PR pcaps: https://buildbot.suricata-ids.org/builders/inliniac-pcap/builds/214