Not all events have a `policy_id`, for instance, if a group is being created or deleted, ditto with `server_id`.  There are also a bunch of other fields that might be included.

Would it make sense to either just create a new dictionary with keys known to be good?  With an exception for timestamp, because it has an `@`

```
event = {}
for key in fields:
    if key in good_keys:
        event[good_key] = fields[good_key]
event['timestamp'] = fields['@timestamp']
```

Probably the list of all good ones is listed in `scripts/history.mapping.json`.