logstash: hadoop: syntax #3

 * rearrange to rename short_message to message first
 * lower case field names
 * split apart to isolate parse failure

Change-Id: Ica640a6bcec9f9bd59f7e15308b49c255fdd5f48