Mapping changes in Elasticsearch 5.0 for string field type

[suyograo]

Elasticsearch is changing string field to split them into two variants: keyword and text. More info about this here: elastic/elasticsearch#12394

The LS template should be changed to reflect this. string_fields rule in template should be split to text_fields and keyword_fields rule. All the fields.raw should be updated to keyword type and @message should be text.

@version should be keyword too.

With this change, LS will be locked with ES version, even with HTTP protocol because this change is not backward compatible.

[suyograo]

@untergeek and I worked with the ES team to make sure existing templates are backward compatible, so this is not going to be a big breaking change. We're gonna clean up existing template to work with 5.0 and also add an enhancement to auto-upgraed templates if ES 5.0 is used.