o365: Additional context around the max_retention (#19037) (#19073)

I think it would be good to get some extra information around the max_retention setting, to make it clear that unless the tenant itself has a longer retention period, then 7 days is going to be all that you can fetch.

Follow-on from investigation behind #18948

(cherry picked from commit 05935ee)

Co-authored-by: AndyHunt66 <andrew.hunt@elastic.co>

filebeat/docs/modules/o365.asciidoc

@@ -189,7 +189,8 @@ endpoints.
 
 The maximum data retention period to support. `168h` by default. {beatname_uc}
 will fetch all retained data for a tenant when run for the first time. The
-default is 7 days. Adjust it if your tenant has a different retention period.
+default is 7 days, which matches the standard period that Microsoft will keep the
+logs before deleting them. Only increase it if your tenant has a longer retention period.
 
 *`var.api.poll_interval`*::
 

x-pack/filebeat/module/o365/_meta/docs.asciidoc

@@ -184,7 +184,8 @@ endpoints.
 
 The maximum data retention period to support. `168h` by default. {beatname_uc}
 will fetch all retained data for a tenant when run for the first time. The
-default is 7 days. Adjust it if your tenant has a different retention period.
+default is 7 days, which matches the standard period that Microsoft will keep the
+logs before deleting them. Only increase it if your tenant has a longer retention period.
 
 *`var.api.poll_interval`*::