Skip to content

Add windows events logs for opentelemetry section#2193

Open
jefchien wants to merge 3 commits into
mainfrom
add-windows-events
Open

Add windows events logs for opentelemetry section#2193
jefchien wants to merge 3 commits into
mainfrom
add-windows-events

Conversation

@jefchien

@jefchien jefchien commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Description of changes

  • Adds opentelemetry.collect.windows_events with:
    • Per-channel OTel pipelines using the upstream windowseventlogreceiver
      • Channel names are sanitized for OTel component IDs (allowlist [a-z0-9-])
      • Stable naming based on channel name (not array index) to prevent checkpoint orphaning on config reorder
    • OTTL-based severity level and event ID filtering
    • Log group/stream routing via resource attributes (aws.log.source, aws.log.channel)
      • Default log group: /aws/cwagent/windows_events
      • Default log stream: {host.id}/{channel}
    • Platform-split default config (default:otel includes System + Application on Windows)
    • JSON schema validation for the new config section
    • Scope tagging (cloudwatch.solution: "otel-windows-events")
    • Shared file_storage extension for checkpoint persistence
  • Metrics pipeline is not activated by windows_events-only configs
  • Generalizes filterprocessor.NewTranslatorWithLogCondition to accept an error mode parameter (was DBI-only, now shared with windows_events).

Unsupported fields compared to logs/logs_collected/windows_events

  • filters (regex-based include/exclude filtering)
  • log_group_class (STANDARD/INFREQUENT_ACCESS)
  • retention_in_days

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tests

  • Unit tests: schema validation (valid + invalid), receiver translator, pipeline translator (parse entries, filter conditions, duplicate channels, channel sanitization), metrics pipeline guard, routing YAML sync test
  • Sample file translation test (windows_events_config.json.yaml, default_otel_config.json.yaml)
  • E2E verified on Windows:
    • OTel-only: logs delivered to CWL, state files created with stable names
    • V1-only: logs delivered to CWL via existing telegraf path
    • Combined (v1 + OTel in same config): both pipelines run in parallel, no conflicts
  • E2E verified on Linux: agent starts without errors (windows_events ignored on non-Windows)

Requirements

Before commiting your code, please do the following steps.

  1. Run make fmt and make fmt-sh
  2. Run make lint

Integration Tests

To run integration tests against this PR, add the ready for testing label.

@jefchien jefchien requested a review from a team as a code owner July 9, 2026 22:07
@jefchien jefchien force-pushed the add-windows-events branch from 3449f76 to da1af20 Compare July 9, 2026 22:08
@jefchien jefchien added the ready for testing Indicates this PR is ready for integration tests to run label Jul 9, 2026
@jefchien jefchien force-pushed the add-windows-events branch 6 times, most recently from 0fd006d to a54956f Compare July 10, 2026 18:39
@jefchien jefchien force-pushed the add-windows-events branch from a54956f to bea91f6 Compare July 13, 2026 20:00
@jefchien jefchien force-pushed the add-windows-events branch from bea91f6 to c4ac8b7 Compare July 13, 2026 21:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready for testing Indicates this PR is ready for integration tests to run

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant