sublime_security: improve file selectors config documentation

[efd6]

Proposed commit message

See title.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes [Sublime Security]: Platform Audit Logs & Message Events are not being parsed #12038

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 20d9544

History

• 💔 Build #21823 failed c5f7b10cc5525e874816834250fcf2c45992a658
• 💚 Build #21691 succeeded f6c75c69c49f643a81d171fe0343601649bb72a5

cc @efd6

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[kcreddy]

Should this be also changed at https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html#_file_selectors?

The docs say:

content_type, parsers, include_s3_metadata,max_bytes, buffer_size, and encoding may also be set for each file selector.

But as per your investigation, when file_selectors is given, content_type is ignored?

[efd6]

Probably it should be changed. The logic is here.

[elastic-vault-github-plugin-prod]

Package sublime_security - 1.5.0 containing this change is available at https://epr.elastic.co/package/sublime_security/1.5.0/