Apparmor and auditd changes

 * Add audit.log in beaver
 * Configure logstash indexer to parse apparmor messages regardless
   if they're coming from syslog or auditd.