logstash: Use doc_values for normalized_message.raw

Change the default mapping to store the normalized_message.raw field
using the doc_values fielddata option which avoids loading values into
memory. This change had previously been applied to all .raw mappings as
shown in <https://phabricator.wikimedia.org/P57> but that was found to
cause issues when the field contained >32k bytes.

Bug: T1269
Change-Id: I6d421c2a8537395821116e238a9338420b0fbec6
Merge "logstash: Use doc_values for normalized_message.raw" into production