Add a field "id" to the json log.

[ddpbsd]

This should match up to the number following Alert in the regular alert log. I'm not sure "id" is descriptive enough, but I wanted to keep it short. Also, I'm not sure it's in the right spot of the log message. Maybe that doesn't even matter.

{"rule":{"level":3,"comment":"Login session closed.","sidid":5502,"group":"pam,syslog,"},"id":"1489183089.253799","decoder":"pam","location":"/var/log/syslog-ng/messages","full_log":"Mar  8 20:13:39 ubnt sudo: pam_unix(sudo:session): session closed for user root","TimeStamp":"Fri Mar 10 16:58:09 2017\n","hostname":"ubnt","program_name":"sudo"}

** Alert 1489183089.253799: - pam,syslog,
2017 Mar 10 16:58:09 ubnt->/var/log/syslog-ng/messages
Rule: 5502 (level 3) -> 'Login session closed.'
Mar  8 20:13:39 ubnt sudo: pam_unix(sudo:session): session closed for user root

---

This change is 

[jrossi]

This looks good to me.