Export http payload

[monicasarbu]

This PR is trying to solve #2143

With this change, the user doesn't need to export the raw request and response in order to index in Elasticsearch the HTTP body. With this PR, the user can specify a list of contact types in the include_body_for configuration option, and export for those HTTP requests/responses the HTTP body under http.request.body or http.response.body.

The PR includes the following changes in the http module of Packetbeat:

• group fields by request and response, so http.request and http.response are created
• add headers to http.request and http.response. If send_all_headers is enabled, then all HTTP headers are exported, if it's disabled then only the Content-Type (if it's not empty) and Content-Length are exported.
• add body to the http.request or http.response if the content-type is part of the include_body_for configuration option.
• export params under http.request
• export code and phrase under http.response

Here is how an HTTP event looks like:

{
  "@timestamp": "2016-08-03T11:47:53.404Z",
  "beat": {
    "hostname": "mar.local",
    "name": "mar.local"
  },
  "bytes_in": 1431,
  "bytes_out": 1997,
  "client_ip": "192.168.0.86",
  "client_port": 50752,
  "client_proc": "",
  "client_server": "",
  "http": {
    "request": {
      "body": "...",
      "headers": {
        "accept": "application/json, text/javascript, */*; q=0.01",
        "accept-encoding": "gzip, deflate",
        "accept-language": "en-US,en;q=0.8",
        "connection": "keep-alive",
        "content-length": "943",
        "content-type": "application/x-www-form-urlencoded; charset=UTF-8",
        "host": "192.168.0.86:9200",
        "origin": "chrome-extension://lhjgkmllcaadmopgmanpapmpjgmfcfig",
        "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
      },
      "params": "..."
    },
    "response": {
      "body": "...",
      "code": 200,
      "headers": {
        "content-length": "1909",
        "content-type": "application/json; charset=UTF-8"
      },
      "phrase": "OK"
    }
  },
  "ip": "192.168.0.86",
  "method": "POST",
  "path": "/logstash-*/_search",
  "port": 9200,
  "proc": "",
  "query": "POST /logstash-*/_search",
  "request": "...",
  "response": "...",
  "responsetime": 362,
  "server": "",
  "status": "OK",
  "type": "http"
}

NOTE: the Packetbeat dashboards need to be updated in a separate PR

[tsg]

We should mention the new body field in the Changelog.

[tsg]

s/is exported/are exported

[monicasarbu]

All the comments were addressed.

[monicasarbu]

The PR is ready for the final review. I added more tests to cover more use cases.

[monicasarbu]

I added a test with a wrong Content-Type value. The POST request generated by Console/Sense/curl contains form-urlencoded in the Content-Type, but the attachment is a JSON object. I opened an issue in Kibana. I adjusted the test to make it pass for now, so the fix is not a blocker.

[tsg]

Did you intend to check more headers here? Like this it's identical to the test above it.