Hmm... so I think logstash always indexes the 'message', but we were going to present it to the user as the key `_message`  (which is in `AUDIT_LOG_FIELDS`) because we didn't want them to depend upon the content of the `_message` field, we want them to parse the structured audit log instead.  The `_message` is just so if some user is reading through the log messages via the API, they can easily see what's going on.

Perhaps this is not actually good idea?  If not, we should probably make the change in the audit log emitter (and the `AUDIT_LOG_FIELDS`), though.