System test generate should always have same output

Currently, when generating `sample_event.json` with `elastic-package system --generate` it seems to use somewhat random event for its sample.
This is a minor issue because that means the sample event in the integration documentation will constantly change which might confuse some users.
This is specially noticeable if a package has multiple input types (log/tcp/udp), one example would be the `fireeye` package. While the initial PR might have samples related to TCP, it seems generating it multiple more times will have an example related to LOG.

Do we know if the order the containers are tested is random? How is the event sample picked for the `sample_event.json`?