Windows input fix

[armstrmi]

Changes

• Implemented fix for the Windows Event Log Input Operator.
• Main fix was to the xml.go file.
• Added tests in xml_test.go and a sample WEL xml file

Link to Tracking Issue
#476

[codecov]

Codecov Report

Merging #478 (df95d8a) into main (70fe7c7) will decrease coverage by 0.1%.
The diff coverage is n/a.

@@           Coverage Diff           @@
##            main    #478     +/-   ##
=======================================
- Coverage   77.0%   76.9%   -0.2%     
=======================================
  Files         85      85             
  Lines       4153    4153             
=======================================
- Hits        3200    3195      -5     
- Misses       669     673      +4     
- Partials     284     285      +1     

Impacted Files	Coverage Δ
operator/transformer/recombine/recombine.go	75.6% <0.0%> (-2.1%)	⬇️
operator/input/tcp/tcp.go	78.4% <0.0%> (-1.6%)	⬇️

[djaglowski]

Can you add a test or two to demonstrate the functionality?

[djaglowski]

Based on the issue description, it sounds like we might expect only one or the other of these. Is that right? If so, should we parse both here and only set whichever one is populated?

[armstrmi]

That would be correct, only one of these would be populated, that being said I'm sure that could be done to only populate one of the fields. But I do have a question about that, would this mean getting rid of the RenderedLevel field of the EventXML struct, or simply removing that field from the output?

[djaglowski]

I would expect that it only requires a change to the body of the log that is emitted.

[BinaryFissionGames]

Just to clarify, both may be populated in the XML. The RenderingInfo tag contains the "friendly" versions of these fields, for instance, System>Level may be 4, but RenderingInfo>Level would be Informational. In this case, both would be present on the XML returned from windows.

Only populating one field might make sense for the sake of removing redundancy, but I just want to clarify.

[armstrmi]

Can you add a test or two to demonstrate the functionality?

@djaglowski there should be some tests in there now

[BinaryFissionGames]

This looks good to me,

[djaglowski]

Thanks @armstrmi