[AWS Firehose] Clarify where to find ES endpoint

[zmoog]

Description

When setting up an AWS Firehose data stream, users should use the Elasticsearch endpoint URL that contains the .es subdomain.

While the non-.es URLs currently work and will continue to function, the URL containing the .es subdomain is designed as the dedicated endpoint for connecting to Elasticsearch. These URLs are the best option for future-proofing your setup, and we should recommend using them.

Documentation sets edited in this PR

Check all that apply.

• Stateful (docs/en/observability/*)
• Serverless (docs/en/serverless/*)
• Integrations Developer Guide (docs/en/integrations/*)
• None of the above

Related issue

Closes #

Checklist

• Product/Engineering Review
• Writer Review

Follow-up tasks

Select one.

• This PR does not need to be ported to another doc set because:
  • The concepts in this PR only apply to one doc set (serverless or stateful)
  • The PR contains edits to both doc sets (serverless and stateful)
• This PR needs to be ported to another doc set:
  • Port to stateful docs: <link to PR or tracking issue>
  • Port to serverless docs: <link to PR or tracking issue>

[github-actions]

A documentation preview will be available soon.

• 🔨 Buildkite builds
• 📚 HTML diff
• 📙 Preview page

Request a new doc build by commenting

• Rebuild this PR: run docs-build
• Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

[mergify]

This pull request does not have a backport label. Could you fix it @zmoog? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-/d./d is the label to automatically backport to the /d./d branch. /d is the digit
  NOTE: backport-skip has been added to this pull request.

[zmoog]

@alaudazzi, we need to clarify users must use ES endpoint format with the es in the URL.

I'm working on the CloudTrail document to find the proper structure before applying it to all other Firehose docs.

The goals are:

• Guide users to pages on EC/deployment that contain the ES endpoint URL with es (there are pages that show the wrong URL format)
• Highlight they must use the ES endpoint URL with es

[zmoog]

@alaudazzi, I made a few changes to the CloudTrail doc as a pilot for this update.

The doc suggests user to find:

• ES endpoint at: EC console > Applications > Elasticsearch > Copy endpoint
• API key at: Kibana > Stack management > API Keys

Added a simplified "IMPORTANT" note for users to double-check hte URL format.

[zmoog]

Here's a low-fi preview from vscode:

[alaudazzi]

Thanks for starting this draft @zmoog -- other than the CloudTrail logs tutorial, which tutorials are impacted by this doc update?

[zmoog]

I guess we need to update the following docs:

• https://github.com/elastic/observability-docs/blob/main/docs/en/observability/cloud-monitoring/aws/monitor-aws-waf-firehose.asciidoc
• https://github.com/elastic/observability-docs/blob/main/docs/en/observability/cloud-monitoring/aws/monitor-aws-firewall-firehose.asciidoc
• https://github.com/elastic/observability-docs/blob/main/docs/en/observability/cloud-monitoring/aws/monitor-aws-cloudwatch-firehose.asciidoc
• https://github.com/elastic/observability-docs/blob/main/docs/en/observability/cloud-monitoring/aws/monitor-aws-cloudtrail-firehose.asciidoc

[alaudazzi]

I tested the Set up a Firehose delivery stream procedure with the current UI and adjusted the steps.

[alaudazzi]

@zmoog
Should we also be more explicit on what to do with the Elasticsearch endpoint URL after we copied it?

[zmoog]

Should we also be more explicit on what to do with the Elasticsearch endpoint URL after we copied it?

You mean the following part is too generic, right?

. Set up the delivery stream by specifying the following data:
+
- Elastic endpoint URL
- API key
- Content encoding: gzip
- Retry duration: 60 (default)
- Backup settings: failed data only to s3 bucket

[alaudazzi]

It could be helpful to expand more on:

• Elastic endpoint URL
• API key

[alaudazzi]

@zmoog

Here is a preview with the latest changes:

Let me know what you think.
I'll fix the typo "To Create the API key"

[zmoog]

LGTM, I'll apply the same changes to the other relevant Firehose guides.

[alaudazzi]

LGTM