Refactoring query builder into ES source

Elasticsearch source now has responsibility to build queries, not each
alert.