Not all events have a `policy_id`, for instance, if a group is being created or deleted, ditto with `server_id`, so this breaks on those particular events.  There are also a bunch of other fields that might be included.

Would it make sense to either just create a new dictionary with keys known to be good?  With an exception for timestamp, because it has an `@`

```
event = {}
for key in fields:
    if key in good_keys:
        event[good_key] = fields[good_key]
event['timestamp'] = fields['@timestamp']
```

Probably the list of all good ones is listed in `scripts/history.mapping.json`.

Running this against our ES instance, this would produce tracebacks such as:

```
Traceback (most recent call last):
  File "/opt/otter/current/lib/python2.7/site-packages/twisted/web/_newclient.py", line 1151, in _bodyDataFinished_CONNECTED
    self._bodyProtocol.connectionLost(reason)
  File "/opt/otter/current/lib/python2.7/site-packages/treq/content.py", line 35, in connectionLost
    self.finished.callback(None)
  File "/opt/otter/current/lib/python2.7/site-packages/twisted/internet/defer.py", line 380, in callback
    self._startRunCallbacks(result)
  File "/opt/otter/current/lib/python2.7/site-packages/twisted/internet/defer.py", line 488, in _startRunCallbacks
    self._runCallbacks()
--- <exception caught here> ---
  File "/opt/otter/current/lib/python2.7/site-packages/twisted/internet/defer.py", line 575, in _runCallbacks
    current.result = callback(current.result, *args, **kw)
  File "/mnt/hgfs/otter/otter/rest/history.py", line 112, in build_response
    'policy_id': fields['policy_id'],
exceptions.KeyError: 'policy_id'
```