Improve CEL input usage/guidance documentation

[ShourieG]

At the moment the CEL input documentation lacks a proper guide that demonstrates via extensive examples, how to implement certain api calls and apply complex logic expressions using CEL. This is possibly a barrier for new/inexperienced users to adopt CEL in place of HTTPJSON.

Proposal: Introduce a guidance section within the CEL doc or have a separate dedicated CEL guide doc that will explain step by step with the help of a sample api's how to write CEL programs in Filebeat config to suit a specific use-case. The doc/guide should start with simple api logic and move towards more complex api requests step by step using separate examples.

Such a documentation with have a big impact on the end user and improve adoption of the CEL input in general.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[efd6]

A diagram like this placed at the Execution section of the CEL input page might be helpful. I don't think mermaid does a good job of the diagram — it makes bad decisions about direction (start should be at the top, but
doing this with TB makes the flow inside the box upside-down) — so it might be better to use graphviz.

flowchart BT
    Start ~~~ Evaluation
    Start --> |initial configured state|Rehydrate(( ))
    Rehydrate --> |rehydrated state| Evaluate[Evaluate CEL Program]
    Wake --> Evaluate
    Sleep -->|Wait| Wake

    subgraph Evaluation
    Evaluate --- Events
    Events([Evaluated state]) --> Publish
    Publish ---o |Events| ES[(Elasticsearch)]
    Publish ---o |Cursor| Cursor[(Cursor store)]
    Cursor --o Rehydrate
    Publish --> Rerun{{at least one event\nand\n`want_more` is true?}}
    Rerun --> |Yes| Evaluate
    end

    Rerun --> |No| Sleep

Loading

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)