Not all events have a `server_id` either I'm afraid :(  Since everything is pretty much covered (except `@timestamp`) in the audit log fields, perhaps the event should only copy over the timestamp?  And then things like `_message`, `scaling_group_id`, and `event_type` are already going to be copied over by the `AUDIT_LOG_FIELDS.keys()` code.