Update grok to parse out syslog levels

[tgross]

As was pointed out by @alrs at the ContainerSummit Day 0 event, the Docker log driver effectively blows away any priority levels of the output from the application. This is an inevitable result of Docker streaming stdout/stderr from the application rather than taking structured logs.

We should add some examples to our logstash grok config to show how to work around the inherent limitation of the log driver and instead parse out textual metadata from the log entry.