Add field content mapping as extractor/converter

[kroepke]

Sometimes it is useful to map field values to other representations while extracting data.
For example the redis severity is a single character, but it would be nice if it was represented just like the syslog severity.

Add a converter type that supports a hash lookup table. That table could be static, or periodically refreshed from some external source.
Be careful to make the converter code path very fast and if the converter is updatable, that should happen on a different thread, replacing the entire table without taking locks.

via a mailing list post

[runningman84]

another use case are firewall logs, you get actions like:

permit
accept
Permitted
allow

these should all map to permit.

[bernd]

See also #302

[kroepke]

Some of this is now possible using the pipeline processing feature in 2.0:
https://gist.github.com/kroepke/27de3bfa2123c5b9ef091888068526cb