- elb fileset
  + cloud.provider
  + event.category
  + event.kind
  + event.outcome
  + http.response.status_code, convert to long
  + http.request.method, lowercase
  + tracing.trace.id

- s3access fileset
  + client.address
  + client.ip
  + geo
  + client.user.id
  + cloud.provider
  + event.action
  + event.code
  + event.duration
  + event.id
  + event.kind
  + event.outcome
  + http.request.referrer
  + http.response.status_code
  + related.user
  + user_agent

- vpcflow fileset
  + cloud.provider
  + cloud.account.id
  + cloud.instance.id
  + event.kind

Closes elastic#16154

- improve grok pattern to make status code a long
- make status code check more readable
- add remote_ip to related.ip