feat(new source): add Windows Event Log source (cherry-pick #24305 + fork fixes)

.github/workflows/integration_windows.yml

@@ -0,0 +1,56 @@
+name: Integration - Windows
+
+on:
+  workflow_dispatch:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      windows: ${{ steps.filter.outputs.windows }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            windows:
+              - "src/sources/windows_event_log/**"
+              - "src/internal_events/windows_event_log.rs"
+              - "tests/integration/windows-event-log/**"
+              - ".github/workflows/integration_windows.yml"
+
+  run-test-integration-windows:
+    needs: changes
+    if: needs.changes.outputs.windows == 'true'
+    runs-on: windows-2025-8core
+    timeout-minutes: 60
+    steps:
+      - name: Checkout branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.10"
+
+      - run: .\scripts\environment\bootstrap-windows-2025.ps1
+
+      - name: Run Windows Event Log integration tests
+        run: make test-integration-windows-event-log
+
+  test-integration-windows:
+    if: always()
+    runs-on: ubuntu-latest
+    needs: run-test-integration-windows
+    steps:
+      - run: |
+          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
+            echo "One or more jobs failed or were cancelled"
+            exit 1
+          fi

Cargo.toml

@@ -360,6 +360,7 @@ bytes.workspace = true
 bytesize.workspace = true
 chrono.workspace = true
 chrono-tz.workspace = true
+cfg-if.workspace = true
 colored = { version = "3.0.0", default-features = false }
 csv = { version = "1.3", default-features = false }
 databend-client = { version = "0.22.2", default-features = false, features = ["rustls"], optional = true }
@@ -453,6 +454,8 @@ reqwest = { version = "0.11", features = ["json"] }
 
 [target.'cfg(windows)'.dependencies]
 windows-service = "0.7.0"
+windows = { version = "0.58", features = ["Win32_System_EventLog", "Win32_Foundation", "Win32_System_Com", "Win32_Security", "Win32_Security_Authorization", "Win32_System_Threading", "Win32_Storage_FileSystem"], optional = true }
+quick-xml = { version = "0.31", default-features = false, features = ["serialize"], optional = true }
 
 [target.'cfg(unix)'.dependencies]
 nix = { version = "0.26.2", default-features = false, features = ["socket", "signal"] }
@@ -630,6 +633,7 @@ sources-logs = [
   "sources-syslog",
   "sources-vector",
   "sources-websocket",
+  "sources-windows_event_log",
 ]
 sources-metrics = [
   "dep:prost",
@@ -708,6 +712,8 @@ sources-utils-net-udp = ["listenfd", "vector-lib/sources-utils-net-udp"]
 sources-utils-net-unix = []
 sources-websocket = ["dep:tokio-tungstenite"]
 sources-wef = ["dep:wef"]
+sources-windows_event_log = ["dep:windows", "dep:quick-xml", "dep:governor", "dep:lru"]
+sources-windows_event_log-integration-tests = ["sources-windows_event_log"]
 
 sources-vector = ["dep:prost", "dep:tonic", "dep:jsonwebtoken", "dep:arc-swap", "protobuf-build"]
 
@@ -924,6 +930,7 @@ all-integration-tests = [
   "splunk-integration-tests",
   "webhdfs-integration-tests",
   "websocket-integration-tests",
+  "windows-event-log-integration-tests",
 ]
 
 amqp-integration-tests = ["sources-amqp", "sinks-amqp"]
@@ -988,6 +995,7 @@ splunk-integration-tests = ["sinks-splunk_hec"]
 dnstap-integration-tests = ["sources-dnstap", "dep:bollard"]
 webhdfs-integration-tests = ["sinks-webhdfs"]
 websocket-integration-tests = ["sources-websocket", "dep:tokio-tungstenite"]
+windows-event-log-integration-tests = ["sources-windows_event_log-integration-tests"]
 disable-resolv-conf = []
 shutdown-tests = ["api", "sinks-blackhole", "sinks-console", "sinks-prometheus", "sources", "transforms-lua", "transforms-remap", "unix"]
 cli-tests = ["sinks-blackhole", "sinks-socket", "sources-demo_logs", "sources-file"]

Makefile

@@ -384,6 +384,14 @@ test-integration: test-integration-nginx test-integration-opentelemetry test-int
 test-integration: test-integration-redis test-integration-splunk test-integration-dnstap test-integration-datadog-agent test-integration-datadog-logs test-integration-e2e-datadog-logs
 test-integration: test-integration-datadog-traces test-integration-shutdown
 
+.PHONY: test-integration-windows-event-log
+test-integration-windows-event-log: ## Runs Windows Event Log integration tests (Windows only)
+ifeq ($(OS),Windows_NT)
+	${MAYBE_ENVIRONMENT_EXEC} cargo test -p vector --no-default-features --features sources-windows_event_log-integration-tests windows_event_log::integration_tests
+else
+	@echo "Skipping windows-event-log integration tests (Windows only)"
+endif
+
 test-integration-%-cleanup:
 	cargo vdev --verbose integration stop $*
 

changelog.d/25194_windows_event_log_lost_wakeup.fix.md

@@ -0,0 +1,3 @@
+The `windows_event_log` source no longer freezes after periods of inactivity.
+
+authors: tot19

changelog.d/25332_windows_event_log_source_metadata.fix.md

@@ -0,0 +1,3 @@
+The `windows_event_log` source now adds standard source metadata, including `source_type`, to emitted log events.
+
+authors: tot19

changelog.d/25521_windows_event_log_span_propagation.fix.md

@@ -0,0 +1,3 @@
+The `windows_event_log` source now propagates the component tracing span into its spawned background tasks, so their internal logs and metrics are correctly tagged with the component.
+
+authors: tot19

changelog.d/windows_event_log_source.feature.md

@@ -0,0 +1,3 @@
+Added a new `windows_event_log` source that collects logs from Windows Event Log channels using the native Windows Event Log API with pull-mode subscriptions, bookmark-based checkpointing, and configurable field filtering.
+
+authors: tot19

src/internal_events/mod.rs

@@ -49,6 +49,12 @@ mod encoding_transcode;
 mod eventstoredb_metrics;
 #[cfg(feature = "sources-exec")]
 mod exec;
+#[cfg(any(
+    feature = "sources-file",
+    feature = "sources-kubernetes_logs",
+    feature = "sinks-file",
+))]
+mod file;
 #[cfg(any(feature = "sources-file_descriptor", feature = "sources-stdin"))]
 mod file_descriptor;
 #[cfg(feature = "transforms-filter")]
@@ -136,6 +142,8 @@ mod websocket;
     feature = "sinks-file",
 ))]
 mod file;
+#[cfg(all(windows, feature = "sources-windows_event_log"))]
+mod windows_event_log;
 mod windows;
 mod hash_replace;
 
@@ -271,6 +279,8 @@ pub(crate) use self::unix::*;
 pub(crate) use self::websocket::*;
 #[cfg(windows)]
 pub(crate) use self::windows::*;
+#[cfg(all(windows, feature = "sources-windows_event_log"))]
+pub(crate) use self::windows_event_log::*;
 pub use self::{
     adaptive_concurrency::*, batch::*, common::*, conditions::*, encoding_transcode::*,
     heartbeat::*, http::*, open::*, process::*, socket::*, tcp::*, template::*, udp::*,