Fix up audit events; add tests

Whaddayaknow, you miss adding a test for some preexisting code, and it
turns out to be broken.

Add a test for type->audit messages from /var/log/audit/audit.log

Add a CATCHALL grok parser, as there were quite a few log lines not
passing the existing ones (o/ _grokparsefailure)
Remove legacy indexer.conf template
Remove legacy upstart config
remove legacy 1.2.2 pillar values
update CHANGELOG
Add an input socket, and optional output archive
Log events to statsd for graphite fun

* all, all by-host
* http status code, all and by-host
Add missing commas - had broken map.jinja :(
Update CHANGELOG