Improve system test coverage for all inputs - 2

[moxarth-rathod]

Proposed commit message

This PR adds system tests for previously untested input types in integrations. Some integrations
support multiple input types (e.g., cloud-based and API-based), but system tests were missing
for some of these inputs. 

The following integrations now include system tests for the missing input types:

- add httpjson system test:
blacklens

- add CEL system test:
checkpoint_harmony_endpoint

- add AWS system test:
cloudflare_logpush

- add azure blob storage system test:
symantec_enpoint_security

- add GCS system test:
cloudflare_logpush
symantec_enpoint_security

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Relates [SSI - System test] Improve system test coverage for the SSI integrations #15144

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 602e852

cc @moxarth-rathod

[kcreddy]

Can you fix indentation of assert.hit_count on this file?
Also add another event and update assert.hit_count: 2 (other inputs too)

[kcreddy]

why change this to flattened?

[kcreddy]

same here

[kcreddy]

Can you check azure* integrations and add explicit mappings here instead of flattened?

[moxarth-rathod]

I ran into an issue during the elastic package check because adding the required fields in the Beats YAML for system tests pushed the total field count beyond the 2048 limit. To resolve this, I had to flatten some of the fields.

[kcreddy]

You could increase the total_fields.limit setting inside the manifest.yml to get around this: Example

[kcreddy]

@ShourieG, can you please review GCS mock service used in the system tests?

[ShourieG]

LGTM for now, I will create a docker image for the mock service and upload to docker registry soon, after that we can remove the redundant mock service code from all the packages and use the image directly