Log messages like "Cannot index events" are not detected anymore in system tests

In #1188, it was added support into elastic-package to check Elastic Agent logs at the end of each system test. Depending on the contents of those logs/messages (taking into account some patterns), those system tests were marked as failure. For instance, if there were messages like: "Cannot index event publisher.Event` (see #1256).

Testing locally some packages with the latest Elastic stack versions, those messages were no longer detected.

It looks like it is related to this PR https://github.com/elastic/elastic-agent/pull/4549

Now messages related to dropping events are written to local files like: state/data/logs/events/elastic-agent-event-log-20250619.ndjson , and they are not shown any more as part of the docker-compose logs.

Example of the message:

{"log.level":"warn","@timestamp":"2025-06-19T10:50:37.228Z","message":"Cannot index event '{...}' (status=400): {\"type\":\"document_parsing_exception\",\"reason\":\"[1:1321] failed to parse field [event.dataset] of type [constant_keyword] in document with id 'dI_Ph5cBatrs-YPd4VMm'. Preview of field's value: 'nginx.access_tf'\",\"caused_by\":{\"type\":\"illegal_argument_exception\",\"reason\":\"[constant_keyword] field [event.dataset] only accepts values that are equal to the value defined in the mappings [nginx.access], but got [nginx.access_tf]\"}}, dropping event!","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"log-default","type":"log"},"log":{"source":"log-default"},"log.origin":{"file.line":519,"file.name":"elasticsearch/client.go","function":"github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.(*Client).applyItemStatus"},"service.name":"filebeat","log.type":"event","ecs.version":"1.6.0","log.logger":"elasticsearch.elasticsearch","ecs.version":"1.6.0"}

Would those errors detected by the Failure Store ? Those checks were removed in https://github.com/elastic/elastic-package/pull/2553 since there were some problems and that feature was in technical preview yet.

Relates:

• Docs about the change in elastic-agent https://github.com/elastic/ingest-docs/pull/1053

Start by tracing the system-test log checks and Failure Store handling, using the event log path state/data/logs/events/elastic-agent-event-log-20250619.ndjson and the linked elastic-agent change as context. Confirm whether dropped-event messages are available there, then document or implement the chosen detection path and verify that affected system tests fail when the example message is present.