[elasticsearch] Decode querylog NDJSON on the Agent

[consulthys]

Proposed commit message

Query log files are already ECS JSON. Filebeat expands them with filestream + ndjson. The integration Agent stream was a plain logfile input, so parsing depended on pipeline-json.yml via the Fleet default_pipeline. That template (priority 200) loses to x-pack logs-elasticsearch.querylog@template (priority 240 after elastic/elasticsearch#158188). Events stayed as a JSON string in message and the dashboard was empty.

This expands NDJSON on the Agent (decode_json_fields + expand_keys), matching Filebeat. The ingest pipeline stays as a fallback for raw message lines (pipeline tests still cover that).

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

cd packages/elasticsearch
elastic-package test pipeline --data-streams querylog
elastic-package test system --data-streams querylog

On a 9.4+ cluster with elasticsearch.querylog.enabled: true and this package installed, documents in logs-elasticsearch.querylog-* should have elasticsearch.querylog.type populated even when logs-elasticsearch.querylog@template is the matching index template.

Related issues

• Closes [Elasticsearch]: querylog Agent stream does not decode NDJSON, so events stay unparsed when the x-pack template wins #20985
• Relates https://github.com/elastic/sdh-elasticsearch/issues/10223
• Relates Lower logs-elasticsearch.querylog@template priority to avoid conflicts elasticsearch#158188

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[adcleared]

Not really my place but raising the possibility that the integration pipeline might be more preferable? This would couple it to stack version and effectively make the existing pipeline for querylog in the integration (which does exist), meaningless?

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: f99f6ba