[proposal, windowseventlog] Create extended_format config for windowseventlogreceiver xml formatting.

[franciscovalentecastro]

Description

Fixes 45926.

Proposing a setting called extended_format config for the windowseventlogreceiver to output all the parsed fields from the XML log record in its "close to the original XML". Having the in-built "robust" parsing is helpful to generate any derived format from the parsed fields.

The "main goal" is to provide an "un-opinionated" setting for the "windowseventlogreceiver" since currently some choices are made for parsed "Messages" (e.g. security channel) and which "Rendered" fields are presented.

Alternatives

• This can be achieved using OTTL ParseSimplifiedXML (or ParseXML) and the "raw: true" setting with different levels of success and robustness :
  • Cons :
    • OTTL has an extensive list of functions, but are missing "robust error handling" (handle parse errors) and "flexible array traversal" (e.g. for loops, etc), so this may not be a fully robust solution.

Context

• [Contrib] This thread [receiver/windowseventlog] Decouple rendering logic from 'raw' #34131 is very relevant.
• [Contrib] Related change : [receiver/windowseventlog] Add suppress_rendering_info parameter and simplify internal logic. #34720.
• [Downstream] My main work : [confgenerator] Fix Message, EventCategory and EventType in windows_event_log_v1. GoogleCloudPlatform/ops-agent#2198

Link to tracking issue

Fixes

Testing

Documentation

[pjanotti]

For now discussing it at the respective issue: #45926.

[pjanotti]

Closing per issue discussion