Cleanup event-handler and fluentd template configs

[kshi36]

This PR aims to fix up inconsistencies in event handler template config files generated from teleport-event-handler configure command. This only affects initial event handler setup for new users and not existing plugin instances. Docs also updated to be consistent.

Changelog: Improved teleport-event-handler configure command with more accurate boilerplate config files

Changes

teleport-event-handler binary and fluentd config:

• Modified audit events endpoint for better clarity: /test.log -> /events.log (matches helm chart)

teleport-plugin-event-handler helm chart:

• Modified session events endpoint to properly match against fluentd matchers: /session.log -> /session
• Modified config's secret names to match the chart name (other access plugins already follow this convention):
  • teleport-event-handler-identity -> teleport-plugin-event-handler-identity
  • teleport-event-handler-client-tls -> teleport-plugin-event-handler-client-tls

Docs:

• Reflect above changes

Manual Test Plan

Test Environment

Teleport Cloud and local Event Handler plugin (binary & helm chart)

Test Cases

• Verify new setup of event handler + fluentd forwarder configs behaves normally
  • executable/docker
  • helm chart

[github-actions]

Amplify deployment status

Branch	Commit	Job ID	Status	Preview	Updated (UTC)
kevin/event-handler-tpl	3ace148	5	✅SUCCEED	kevin-event-handler-tpl	2026-07-15 17:04:41

---

Preview links for changed docs pages

• docs/pages/reference/deployment/monitoring/event-handler.mdx
• docs/pages/zero-trust-access/export-audit-events/datadog.mdx — affected partials: event-handler-operator-helm-config.mdx, finish-event-handler-config.mdx, finish-event-handler-fields.mdx
• docs/pages/zero-trust-access/export-audit-events/elastic-stack.mdx — affected partials: event-handler-operator-helm-config.mdx, finish-event-handler-config.mdx, finish-event-handler-fields.mdx
• docs/pages/zero-trust-access/export-audit-events/event-handler-setup-operator.mdx — affected partial: event-handler-operator-helm-config.mdx
• docs/pages/zero-trust-access/export-audit-events/event-handler-setup.mdx
• docs/pages/zero-trust-access/export-audit-events/fluentd.mdx — affected partials: event-handler-operator-helm-config.mdx, finish-event-handler-config.mdx, finish-event-handler-fields.mdx
• docs/pages/zero-trust-access/export-audit-events/panther.mdx — affected partials: event-handler-operator-helm-config.mdx, finish-event-handler-config.mdx, finish-event-handler-fields.mdx
• docs/pages/zero-trust-access/export-audit-events/splunk.mdx — affected partials: event-handler-operator-helm-config.mdx, finish-event-handler-config.mdx, finish-event-handler-fields.mdx

[backport-bot-workflows]

@kshi36 See the table below for backport results.

Branch	Result
branch/v18	Failed