x-pack/filebeat/input/cel: improve missing events error value

CEL programs used in the CEL input are specific to return an object that
includes an array. This is tested for, but currently the check is
indirect and only shows that the type is not expected, rather than a
more informative message that the events array is missing. This changes
that so that when no events field is present, an error is returned
directly. This will flow on to a status update in the handling of the
returned error by the input Run method, alerting the user more promptly
to the cause. Since a CEL input program is not valid if it returns no
events field, a hard error (fleet status failed rather than degraded)
seems appropriate.

CHANGELOG.next.asciidoc

@@ -278,6 +278,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Update CEL mito extensions to v1.15.0. {pull}40294[40294]
 - Allow cross-region bucket configuration in s3 input. {issue}22161[22161] {pull}40309[40309]
 - Improve logging in Okta Entity Analytics provider. {issue}40106[40106] {pull}40347[40347]
+- Improve error quality when CEL program does not correctly return an events array. {pull}40580[40580]
 
 *Auditbeat*
 

x-pack/filebeat/input/cel/input.go

@@ -366,9 +366,7 @@ func (i input) run(env v2.Context, src *source, cursor map[string]interface{}, p
 
 			e, ok := state["events"]
 			if !ok {
-				log.Error("unexpected missing events array from evaluation")
-				env.UpdateStatus(status.Degraded, "unexpected missing events array from evaluation")
-				isDegraded = true
+				return errors.New("unexpected missing events array from evaluation")
 			}
 			var events []interface{}
 			switch e := e.(type) {