Follow up to #10352 per #10352 (comment):

While working on this PR I realized that we don't have sample lines for the structured elasticsearch audit log containing a request body (which is supposed to be parsed into the http.request.body.content field). I'm working with @albertzaharovits to get such a sample and will incorporate it into follow up PRs (for master and 6.x).

Accordingly, this PR adds sample lines to the structured and unstructured log file test fixtures for the elasticsearch/audit fileset and teaches the fileset to parse any new fields encountered in these sample lines.