Make e-r compatible with old/new logstash schemas.

* elastic_recheck/elasticRecheck.py: Update templated queries to use non
'@' prefixed fields and flatten the old '@fields' field. This is
possible because query for foo_field will find foo_field and
@fields.foo_field. Also, handle the case where @fields may not be
present in the query results.

* queries.yaml: Update queries using the same rules as in
elasticRecheck.py

Change-Id: I48672912d05c7ad557e948cfef0402c7c89582f6