Fix up audit events; add tests

Whaddayaknow, you miss adding a test for some preexisting code, and it
turns out to be broken.

Add a test for type->audit messages from /var/log/audit/audit.log

Add a CATCHALL grok parser, as there were quite a few log lines not
passing the existing ones (o/ _grokparsefailure)
Remove legacy indexer.conf template