Update elasticsearch fields to use "_" rather than "."

Update elasticsearch fields to use "_" rather than "."

It seems that while elasticsearch can have data in a field as well as sub-fields, logstash
can't currently do this (it stores the event in a hash, so an entry either contains data
or another hash or list).

Work around this by using underscores, which should in theory also mean these examples will
work with elasticsearch 2, though I haven't tried it.