Fix Windows event log set IP to correct address

[r00tu53r]

What does this PR do?

Fix Windows event log set IP to correct address

• Add templating around _ingest._value so that the literal
  value of "_ingest._value" is not set to related.ip
• Update tests

Closes #1728

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

How to test this PR locally

From package/windows -

elastic-package test pipeline

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-10-14T07:12:10.072+0000

• Duration: 17 min 37 sec

• Commit: ddf9267

Test stats 🧪

Test	Results
Failed	0
Passed	126
Skipped	0
Total	126

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[P1llus]

LGTM! :)