Replace constant with string literals in streaming audit events specs

The following discussion from !128313 (merged) should be addressed: