[pkg/stanza/operator/input/windows] [receiver/windowseventlogreceiver] add raw XML query support

[OverOrion]

Example usage

receivers:
  windowseventlog/query:
    raw: true
    query: |
      <QueryList>
        <Query Id="0">
          <Select Path="Application">*[System[Provider[@Name='foo']]]</Select>
          <Select Path="Application">*[System[Provider[@Name='bar']]]</Select>
        </Query>
      </QueryList>

exporters:
  debug:
    verbosity: detailed

service:
  pipelines:
    logs/query:
      receivers: [windowseventlog/query]
      exporters: [debug]

I tested it using eventcreate:

eventcreate /t ERROR /id 100 /l application /d "Create event in application log"  /so foo

[pjanotti]

@OverOrion sorry for the delay - this is looking good! We will need a test before this can be approved and merged. It will be good to add some examples and links on the README.md - something like https://learn.microsoft.com/en-us/previous-versions/aa385231(v=vs.85)#xml-event-queries for instance.

[OverOrion]

Hey @pjanotti

I have extended the README with a sample configuration, let me know if that's what you had in your mind.

[pjanotti]

Hi @OverOrion - I was in a short break last week, will take a look soon.

[pjanotti]

@OverOrion - changes are looking good, the test that I was thinking about would be like the ones in receiver/windowseventlogreceiver/receiver_windows_test.go, but, using the Query on the config. Perhaps TestReadWindowsEventLogger

[OverOrion]

Added a similar test:

> go test -count=1 . -v
=== RUN   TestNewFactory
=== RUN   TestNewFactory/NewFactoryCorrectType
--- PASS: TestNewFactory (0.00s)
    --- PASS: TestNewFactory/NewFactoryCorrectType (0.00s)
=== RUN   TestCreateDefaultConfig
--- PASS: TestCreateDefaultConfig (0.00s)
=== RUN   TestCreateAndShutdown
--- PASS: TestCreateAndShutdown (0.00s)
=== RUN   TestComponentFactoryType
--- PASS: TestComponentFactoryType (0.00s)
=== RUN   TestComponentConfigStruct
--- PASS: TestComponentConfigStruct (0.00s)
=== RUN   TestComponentLifecycle
=== RUN   TestComponentLifecycle/logs-shutdown
=== RUN   TestComponentLifecycle/logs-lifecycle
--- PASS: TestComponentLifecycle (0.00s)
    --- PASS: TestComponentLifecycle/logs-shutdown (0.00s)
    --- PASS: TestComponentLifecycle/logs-lifecycle (0.00s)
=== RUN   TestDefaultConfig
--- PASS: TestDefaultConfig (0.00s)
=== RUN   TestLoadConfig
--- PASS: TestLoadConfig (0.00s)
=== RUN   TestCreateWithInvalidInputConfig
--- PASS: TestCreateWithInvalidInputConfig (0.00s)
=== RUN   TestReadWindowsEventLogger
--- PASS: TestReadWindowsEventLogger (4.51s)
=== RUN   TestReadWindowsEventLoggerWithQuery
--- PASS: TestReadWindowsEventLoggerWithQuery (4.51s)
=== RUN   TestReadWindowsEventLoggerRaw
--- PASS: TestReadWindowsEventLoggerRaw (4.55s)
=== RUN   TestExcludeProvider
=== RUN   TestExcludeProvider/with_EventXML
=== RUN   TestExcludeProvider/with_Raw
--- PASS: TestExcludeProvider (9.09s)
    --- PASS: TestExcludeProvider/with_EventXML (4.28s)
    --- PASS: TestExcludeProvider/with_Raw (4.26s)
PASS
ok      github.com/open-telemetry/opentelemetry-collector-contrib/receiver/windowseventlogreceiver      22.719s

[pjanotti]

Thanks @OverOrion!

CI failure is unrelated, tracking via #39691