Log event schema conventions

[tj]

Before getting too crazy with integrations it would be great to have some conventions for source information, and common events such as http request/responses. These fields could then be special-cased a bit to provide a nicer display.

• decide
• alter cloudwatch integration
• document