Send "service" column from zeek logs

[tg]

Zeek IP logs (conn.log) contain "service" column with application protocol, if detected. We can find values like "dns" or "ssl" in there. We should send it upstream as an "app" field.