use source.ip instead of host.ip

[nelson-vineti]

It's better to use source.ip instead of host.ip for the following reasons:

• Elastic references source.ip in much of their builtin Security detections.
• host.ip usually indicates a server.

[nelson-vineti]

Thanks for the review @ogero . I think I've got the necessary bits in ecs.go