(WIP) Handlers in pillar

* Elastic search check take comma seperated list of handlers
* Set apparmor check to use default handler
* Allow specifying handler in pillar
* Don't ship server log, too noisy.
Another option might be to drop the lines we aren't interested in (i.e. the checks being run. I think this info isn't useful to us as we get it from the alerts/server log anyway)

```
filter {
  if [loglevel] == "debug" { 
    drop { } 
  }
}
```