winlogbeat/eventlog: ensure event loggers restart metric collection when handling recoverable errors

[efd6]

Proposed commit message

When winlogbeat's event loggers encounter recoverable errors they handle this by closing and reopening the channel. This causes the metric collection for the beat and dependent winlog filebeat input to lose metric collection as metric registration only occurs on configuration. So move metric registration to the channel open method. To avoid reregistration of metrics, use the nilness of the metric field to guard against this.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Fixes [Filebeat] winlog input metrics are unregistered after recovery #36479

Use cases

Screenshots

Logs

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-09-01T02:02:07.112+0000

• Duration: 40 min 10 sec

Test stats 🧪

Test	Results
Failed	0
Passed	936
Skipped	9
Total	945

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

This will make it better in that we will have metrics after a recovery. One concern I have is that we lose the cumulative metric state for the input after any major error. If you rely on the metrics alone (without looking at logged errors) then I think you would miss that there had been some issue (albeit recovered).

[efd6]

The alternative that I considered was to add a Reset method which would essentially be a Close/Open pair without the metrics reset. I did not do this because it would likely have been more invasive. I issue is that we are forced by OS design to conflate Close with reset. I'm happy to add the Reset approach if you would prefer.

[efd6]

Counter proposal is here.

Shifting my vote toward #36483.

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 36479-winlog_winlogbeat upstream/36479-winlog_winlogbeat
git merge upstream/main
git push upstream 36479-winlog_winlogbeat