Check the correct grok failure tag, workaround for logstash bug #1849 

Turns out I missed checking the correct tag name on the filter.  Not sure how we can test for that, as the only thing that would be present would be the failure tag (which we're already testing for).

Also capture the hostname correctly, as tcp/udp inputs currently include ip:port (rather than just IP) - [Logstash bug #1849](https://logstash.jira.com/browse/LOGSTASH-1849)