New component: Windows Event Log Receiver

[armstrmi]

The purpose and use-cases of the new component

The windowseventlog receiver reads logs from the windows event log API.

Example configuration for the component

Field	Default	Description
id	windows_eventlog_input	A unique identifier for the operator
output	Next in pipeline	The connected operator(s) that will receive all outbound entries
channel	required	The windows event log channel to monitor
max_reads	100	The maximum number of records read into memory, before beginning a new batch
start_at	end	On first startup, where to start reading logs from the API. Options are beginning or end
poll_interval	1s	The interval at which the channel is checked for new log entries. This check begins again after all new bodies have been read.
attributes	{}	A map of key: value pairs to add to the entry's attributes.
resource	{}	A map of key: value pairs to add to the entry's resource.
operators	[]	An array of operators. See below for more details
converter	{ max_flush_count: 100, flush_interval: 100ms, worker_count: max(1,runtime.NumCPU()/4) }	A map of key: value pairs to configure the [entry.Entry][entry_link] to [pdata.LogRecord][pdata_logrecord_link] converter, more info can be found [here][converter_link]

The following configuration settings are required:

• channel

The remaining configuration settings are optional

Configuration:

- type: windowseventlog
  channel: application

Telemetry data types supported

Logs

Sponsor (Optional)

[djaglowski]

@armstrmi, I assume the telemetry type is Logs, not Metrics?

This will be based on the log-collection library's windows event log operator, right? If so, the config appears to be slightly out of date.

Assuming I'm right about the above, I'm happy to sponsor this. #2333 has been open for quite some time, but I think it's good to follow the new process anyways.

[gillg]

It would be perfect if in addition we can configure a remote host instead of localhost.
The idea behind is to collect logs inside windows containers, and it's actually a nightmare.
A fluentd plugin seems implement it https://github.com/fluent/fluent-plugin-windows-eventlog/blob/5ea69686a2c4aef9053b4f139cd0bd63271b9419/lib/fluent/plugin/in_windows_eventlog2.rb#L101 but with not a lot of feedback.

[armstrmi]

@djaglowski Yup, was meant to be Logs, my bad. And it is based on that log collection windows operator. Can update that config, @gillg I will get back to you on configuring a remote host

[djaglowski]

Ideally, such a component will support both local and remote collection eventually, but either is valuable without the other. The hard part is done already for the local implementation, so it makes a lot of sense to expose it in a receiver.

That said, if we are expecting to add remote collection at a later point, we should get a sense of the necessary configuration details. Would they be additive or conflicting? If conflicting this could alter the config we present to users, so this is something we should establish sooner rather than later.

I would like to sponsor this component, but we should answer the config question before merging the receiver.

[armstrmi]

@djaglowski config question I believe has been resolved, changed it let me know what you think

[djaglowski]

@djaglowski config question I believe has been resolved, changed it let me know what you think

I am not sure what you are referring to as the resolution.

[armstrmi]

@djaglowski config question I believe has been resolved, changed it let me know what you think

I am not sure what you are referring to as the resolution.

So in response to your question about whether or not configuring a remote collection would be additive or conflicting, turns out it would be additive after looking at how fluentd and other log collection platforms accomplish this. Here you can see how they config the "subscribe" section for collecting remote event logs.

So because of what we found, I think it would be safe to move forward and we can add remote collection on at a later point.

[djaglowski]

Thanks for looking into it @armstrmi. I've investigated this myself a bit and have come to the same conclusion.

[djaglowski]

Closed by #9228

[Narcissus666]

@armstrmi Hi, I want to know to configuring a remote host in Windows Event Log Receiver.
Can you help me?
Thank you~

[Narcissus666]

@gillg Hi, Do you know how to configure a remote host in Windows Event Log Receiver?
Can you tell me?
Thank you~