Add event_data to common template so elastalert/playbook event_data fields can be indexed and searchable

salt/elasticsearch/templates/so/so-common-template.json

@@ -228,7 +228,11 @@
         "event":{
           "type":"object",
           "dynamic": true
-        }, 
+        },
+        "event_data":{
+          "type":"object",
+          "dynamic": true
+        },	
         "file":{
           "type":"object",
           "dynamic": true