in_winlog: split an identifier into "EventID" and "Qualifiers" (#3121)
in_winlog: split an identifier into "EventID" and "Qualifiers" (#3121)

This changes the plugin to emit `EVENTLOGRECORD.EventID` as two
separate fields.

i.e. it splits an event identifier into:

    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |S|R|C|N|r|    Facility         |               Code            |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    -------------------------------- --------------------------------
            Qualifiers                          EventID

This is how Windows Event Viewer treats the field, and hence this is
what most users expect.

Signed-off-by: Fujimoto Seiji <ef879192bb1e41d519c82cf76440dc8e9a530806@ceptord.net>
nokute78/fluent-bit,fluent/fluent-bit,fluent/fluent-bit,fluent/fluent-bit,fluent/fluent-bit,nokute78/fluent-bit,nokute78/fluent-bit,fluent/fluent-bit,nokute78/fluent-bit,nokute78/fluent-bit,nokute78/fluent-bit,fluent/fluent-bit,fluent/fluent-bit,fluent/fluent-bit,nokute78/fluent-bit,nokute78/fluent-bit,fluent/fluent-bit,fluent/fluent-bit,nokute78/fluent-bit,nokute78/fluent-bit,nokute78/fluent-bit,fluent/fluent-bit,fluent/fluent-bit,nokute78/fluent-bit