[box_events] Migrate to the CEL input

[chrisberkhout]

Proposed commit message

[box_events] Migrate to the CEL input

Migrate from the HTTPJSON input to the CEL input, parsing responses so
that the `next_stream_position` cursor value is handled as a string
end-to-end. This fixes rounding of stream position values above 2^53,
which could cause data gaps.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Closes box_events: cursor offset is outside range of exact integer representation #14320

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[chrisberkhout]

@efd6 Thanks for the CEL edits. I did add a sentence about admin_logs_streaming for admin_logs.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[vera-review-bot]

🟢 No issues across the latest commits 4be0916, efbbff2.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.2.7 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: efbbff2

History

• 💚 Build #48439 succeeded 5ad59d8

cc @chrisberkhout

[efd6]

I'm happy with this but let's wait for PM review.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request