Update JSON key locations

[8bitbuddhist]

When parsing the JSON file, the script expects "_app" and "_line" to be top level attributes, when they are actually second level attributes under "_source". This change modifies the script to account for this.

Sample log event:

{
  "_index": "logline.[prefix].2019-05-02.23",
  "_type": "logdna",
  "_id": "",
  "_score": 1,
  "_source": {
    ...
    "_file": "/var/log/daemon.log",
    "_line": "May  1 20:02:52 node1 microk8s.daemon-kubelet[7436]: E0501 20:02:52.363346    7436 kuberuntime_manager.go:780] container start failed: ErrImageNeverPull: Container image \"iotsimulator\" is not present with pull policy of Never",
    "_ts": 1556755373353,
    "_app": "daemon.log"
  }
}

[chrisvaughn]

Thanks for the update. It looks like the JSON format also changed in Oct 2018. There is a test data file test_data\testlog.json.gz that needs to be updated to the new format for the tests to pass.

[8bitbuddhist]

Hey Chris, thanks for getting back to me! I'll see about updating the data and re-running the tests before pushing any more changes.