[8.14](backport #39544) [winlogbeat] performance improvment; avoid rendering event message twice

[mergify]

Proposed commit message

The change increases events-per-second throughput by about 30%.

I have improved the throughput by using a fixed buffer size at first attempt of message parsing.

I thought about adding a config parameter to control the size of the initial buffer but after some research I believe it's not needed. I use the size 16KB already existing in our code base. It's relatively small, but the majority of windows event log messages are even much smaller. Historically the event log was designed to store only a message templates to be filled in with actual strings or values from external resources when viewing.

This PR does not pose a regression risk, related to #35437 The former code was prone to error, on certain Windows releases, by using the out parameter BufferUsed instead of relying only on C-style string format when handling the output. The documentation of this parameter is a bit vague, in practice it's only needed when ERROR_INSUFFICIENT_BUFFER is returned.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

Setup a reasonably large VM, for example 8 CPU, 32 GB RAM. Prepare an event log with thousands of entries (or just create empty event log and prepare a tool to quickly produce events).
Prepare winlogbeat.yaml config pointing to the event log, use file output. Configure http statistics endpoint to periodically check the progress. Run winlogbeat.exe with the same config, on the same machine, before and after the change or run them side-by-side. Observe the increased events-per-second throughput.

Related issues

• Closes [winlogbeat] Throughput degradation #39530

Use cases

Screenshots

Logs

---

This is an automatic backport of pull request #39544 done by [Mergify](https://mergify.com).

[botelastic]

This pull request doesn't have a Team:<team> label.