[Website]: Zscaler ZIA Web Log Stream Fails with HTTP 400 "malformed JSON" Errors

### Before you submit

- [x] This issue is about a documentation page, flow, or piece of content.

### Type of issue

Missing information

### What documentation page or section is affected

https://www.elastic.co/docs/reference/integrations/zscaler_zia

### What happened?

Hey team, I'm opening this PR as while working with a customer, I've found some missing information on the documentation:

The documentation is missing important information about Zscaler ZIA using Cloud Feed NSS.

- Zscaler sends information using gzip compression, and without adding the proper HTTP headers, the ingestion fails.
More info on this KB I've created -> https://support.elastic.dev/knowledge/view/2853a13a
- On the same topic, the documentation mentions `Add an API URL.`. However, it does not mention what API URL it should be used on Zscaler side to send data to Elastic Agent. This should be better explained in the documentation, where the correct API URL is the Elastic Agent IP and port configured on the integration.

### Additional info

Please let me know if you have any questions.

---

## Elastic Docs AI Scoping 🤖

Docs issue scope

### Summary
The issue reports two missing pieces of information in the Zscaler ZIA integration docs for the **Cloud NSS Feeds** setup flow. The issue asks for: (1) documentation that Zscaler sends data with gzip compression and that the HTTP Endpoint input must be configured to accept it, and (2) a clearer explanation of what "API URL" means — specifically that it should be the Elastic Agent's IP and port running the HTTP Endpoint listener. Inspection of the source README (`packages/zscaler_zia/docs/README.md` in `elastic/integrations`) confirms both gaps are real: the "Set up Cloud NSS Feeds" section says "Add an API URL" with no further guidance, and gzip/HTTP-header requirements are not mentioned anywhere in the file.

### Request accuracy
Accurate — both gaps are confirmed in the current source README.

### Next action for author
Update the "Set up Cloud NSS Feeds" section in `packages/zscaler_zia/docs/README.md` in the `elastic/integrations` repo to add gzip compression guidance and clarify the API URL format.

### Impact: High

### Scope boundary
The TCP-based NSS Feed setup and all other data streams (Alerts, DNS, Firewall, etc.) do not appear to need changes — the gaps are specific to the Cloud NSS Feeds / HTTP Endpoint path.

### Recommended documentation targets

| Page | URL | Action | Impact | Confidence | Why this page? |
|------|-----|--------|--------|------------|----------------|
| Zscaler ZIA integration | https://www.elastic.co/docs/reference/integrations/zscaler_zia | Update existing page | High | High | The "Set up Cloud NSS Feeds" section on this page is the direct location of both gaps |

### Recommendations

1. In the **"Set up Cloud NSS Feeds"** section, replace the bare "Add an API URL" bullet with an explicit explanation: the API URL is the HTTP Endpoint URL exposed by the Elastic Agent (format: `(redacted) where the port matches the integration's HTTP Endpoint listener configuration.
2. In the same section, add a note that Zscaler Cloud NSS Feeds send data with **gzip compression** and that the Elastic Agent HTTP Endpoint input must be configured to accept it, or document the required HTTP headers that Zscaler must send so the Elastic Agent decodes the payload correctly.

### Notes

- The source file to edit is `packages/zscaler_zia/docs/README.md` in the [`elastic/integrations`](https://github.com/elastic/integrations) repo — changes there publish to the docs page above.
- No new page is needed; both items fit naturally as additional bullets or a note block in the existing setup section.
- Consider adding a troubleshooting note (HTTP 400 "malformed JSON") pointing to the gzip header requirement, since that is the failure mode described in the issue title.

> Generated by [Issue Scope Analyzer](https://github.com/elastic/docs-content/actions/runs/25542416335/agentic_workflow) for issue #6356 · ● 567.6K · [◷](https://github.com/search?q=repo%3Aelastic%2Fdocs-content+is%3Aissue+%22gh-aw-workflow-call-id%3A+elastic%2Fdocs-content%2Fgh-aw-docs-issue-scope%22&type=issues)