Use journal namespace to avoid _uid collision and for journalbeat compatibility

[opoplawski]

Running with 6.4.2 I get the following error:

[2018-10-05T14:44:45,967][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"journald-2018.10.03", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x388a5282>], :response=>{"index"=>{"_index"=>"journald-2018.10.03", "_type"=>"doc", "_id"=>"8otnRmYBZ4A3W5U1lGZl", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"Field [_uid] is a metadata field and cannot be added inside a document. Use the index API request parameters."}}}}

A discussion group post led me to use:

filter {
  mutate {
    rename => { "_uid" => "_effective_uid" }
  }
}

However, journalbeat uses a "journal" namespace for the journal metadata, e.g.:

    "journal": {
      "syslog_identifier": "kibana",
      "cap_effective": "0",
      "selinux_context": "system_u:system_r:init_t:s0",
      "hostname": "elk.nwra.com",
      "uid": "992",
      "syslog_facility": "error",
      "systemd_unit": "kibana.service",
      "stream_id": "902fcf16458e4e2fb0e522b342e8c578",
      "machine_id": "588485978866449297e7a342815a1262",
      "gid": "988",
      "boot_id": "b95d40f396604a8d9fbcececfcf7402e",
      "systemd_cgroup": "/system.slice/kibana.service",
      "pid": "453",
      "comm": "node",
      "priority": "informational",
      "cmdline": "/usr/share/kibana/bin/../node/bin/node --no-warnings /usr/share/kibana/bin/../src/cli -c /etc/kibana/kibana.yml",
      "exe": "/usr/share/kibana/node/bin/node",
      "systemd_slice": "system.slice",
      "transport": "stdout"
    },

Which seems like a good idea to me.