x-pack/filebeat/input/cel: improve missing events error value

[efd6]

CEL programs used in the CEL input are specific to return an object that includes an array. This is tested for, but currently the check is indirect and only shows that the type is not expected, rather than a more informative message that the events array is missing. This changes that so that when no events field is present, an error is returned directly. This will flow on to a status update in the handling of the returned error by the input Run method, alerting the user more promptly to the cause. Since a CEL input program is not valid if it returns no events field, a hard error (fleet status failed rather than degraded) seems appropriate.

Proposed commit message

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 10831-cel upstream/10831-cel
git merge upstream/main
git push upstream 10831-cel

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 10831-cel upstream/10831-cel
git merge upstream/main
git push upstream 10831-cel

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 10831-cel upstream/10831-cel
git merge upstream/main
git push upstream 10831-cel