[System] Add custom configuration option to winlog inputs

[user-987654321]

Proposed commit message

Adding the ability for users to set custom yaml config for windows datastream (System, Application, Security) winlog inputs.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[cla-checker-service]

💚 CLA has been signed

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[andrewkroh]

LGTM. Appears to be consistent with #8877.

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[andrewkroh]

/test

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[ishleenk17]

@andrewkroh :
This could potentially broaden the range of configurations for Winlog, given that it accepts any configuration in YAML format. Hence, increasing the likelihood of integration breakages.
Would it be better to give a specific yaml box for the requirement like we do for say SSL.

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[ishleenk17]

@andrewkroh : Please see if we would like to proceed with this change. I had one concern as mentioned here.

[andrewkroh]

Hence, increasing the likelihood of integration breakages. Would it be better to give a specific yaml box for the requirement like we do for say SSL.

This is true given that there is no validation of the YAML. But I don't think scoping the YAML to one setting (like ssl: {{ssl}}) is any better because no matter where the invalid YAML is placed it will break the configuration. It's the same problem that exists for processors. So I don't think this drastically increases the risk of invalid configurations.

I would like to see us build a UI component that encapsulates all of the winlog input settings. It would encode all of the validation rules like mutual exclusivity between options, provide type-ahead for the most common channel names, and do validiton of the processors YAML based on json-schema. This would be a better UX and reduce this risk of saving an invalid config.

[andrewkroh]

/test

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 599c83b

History

• 💚 Build #10099 succeeded 5d33cbc

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

Package system - 1.56.0 containing this change is available at https://epr.elastic.co/search?package=system