logs contract: more robust field finding, explicit approach

[gabor]

(there are two approaches, i created two PRs for the two approaches. this one, and #661. we should only merge one of them)

this PR clarifies a corner-case that can happen when finding the timestamp and the message field.

(please note, both the severity and id fields are string-fields, so as soon as any of these two is added to the dataframe, we will hit the "two string fields" situation.)

pro: explicit about what happens when more than one string fields exist
con: non backward-compatible (for example, Loki&Elastic dataframes simply make sure the message field is the first string field)

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[yesoreyeram]

I prefer this over #661