Cherry-pick #20370 to 7.9: Check expand_event_list_from_field when json in map[string]interface{} format

[kaiyan-sheng]

Cherry-pick of PR #20370 to 7.9 branch. Original message:

What does this PR do?

When json is in map[string]interface{} format, s3 input should also check for expand_event_list_from_field config parameter.
With this PR, cloudtrail fileset is working again:

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request #20373 updated]

• Start Time: 2020-07-31T03:04:10.538+0000

• Duration: 57 min 57 sec

Test stats 🧪

Test	Results
Failed	0
Passed	2434
Skipped	385
Total	2819

Steps errors

Expand to view the steps failures

• Name: Install Go 1.14.4

  • Description: .ci/scripts/install-go.sh

  • Duration: 1 min 57 sec

  • Start Time: 2020-07-31T03:29:28.764+0000

  • log