fix truncated event log message

[intxgo]

Fixes

• [winlogbeat] Windows event log XMLs are truncated if exceed 8KB #41245

Proposed commit message

Fix windows event log ingest issues caused by event message truncation.

1. Increased scratch buffer size from 8K wide characters to 256K wide characters. The scratch buffer is used for efficiency, one buffer per event source. It was set really low.
2. Handling insufficient scratch buffer size condition. Windows API documentation is not very clear about it but the APIs return ERROR_INSUFFICIENT_BUFFER only when used with nil buffer, otherwise they happily succeed copying as much as the given buffer allows (truncating message). In such case we will retry with an ad-hoc pool buffer of sufficient size. In real world the initial 256K characters buffer should be large enough, so this is really a what-if fallback.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[mergify]

backport-8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label and remove the backport-8.x label.

[intxgo]

>> check: Checking source code for common problems
Error: some files are not up-to-date. Run 'make update' then review and commit the changes. Modified: [winlogbeat/docs/modules_list.asciidoc]
make[1]: *** [../libbeat/scripts/Makefile:153: check] Error 1
make[1]: Leaving directory '/home/runner/work/beats/beats/winlogbeat'
make: *** [Makefile:94: check] Error 1
Error: Process completed with exit code 2.

I'm not sure how can I do it on Windows, it seems to be Linux hint?