Logstash ECS to CEF

Produces Common Event Format (CEF) events for ingestion by ArcSight, from Elastic Common Schema (ECS) events.

Roughly based on the mapping spreadsheet from this ECS Github Issue

Suggestions for improvements welcome.