Cherry-pick #16441 to 7.x: [Filebeat] Check expand_event_list_from_field before checking content-type

[kaiyan-sheng]

Cherry-pick of PR #16441 to 7.x branch. Original message:

What does this PR do?

This PR is to fix s3 input reading json format logs. When expand_event_list_from_field config is given, such as cloudtrail fileset, s3 input should use json.NewDecoder first. If this expand_event_list_from_field is not given, then check content-type and use gzip.NewReader.

Why is it important?

This will fix s3 input when using cloudtrail fileset.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works

Related issues

• Closes [Filebeat] S3 input issue for cloudtrail: createEventsFromS3Info failed #16374

Screenshots

When Metadata is set as below:

I was able to read the cloudtrail json.gz file as shown below in Kibana: