From 6ec40400de76049443a12297d95f57b44692a647 Mon Sep 17 00:00:00 2001
From: okankoAMZ <107267850+okankoAMZ@users.noreply.github.com>
Date: Fri, 15 Sep 2023 16:54:35 -0400
Subject: [PATCH] Fix windows event logs to only starts once (#851)

---
 .../windows_event_log/windows_event_log.go    | 10 ++++++++++
 .../windows_event_log_test.go                 | 20 +++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/plugins/inputs/windows_event_log/windows_event_log.go b/plugins/inputs/windows_event_log/windows_event_log.go
index ad38d367a4..211cabba68 100644
--- a/plugins/inputs/windows_event_log/windows_event_log.go
+++ b/plugins/inputs/windows_event_log/windows_event_log.go
@@ -11,6 +11,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/influxdata/telegraf"
@@ -25,6 +26,8 @@ const (
 	forcePullInterval = 250 * time.Millisecond
 )
 
+var startOnlyOnce sync.Once
+
 type EventConfig struct {
 	Name          string   `toml:"event_name"`
 	Levels        []string `toml:"event_levels"`
@@ -77,6 +80,13 @@ func (s *Plugin) FindLogSrc() []logs.LogSrc {
  * We can do any initialization in this method.
  */
 func (s *Plugin) Start(acc telegraf.Accumulator) error {
+	alreadyRan := true
+	startOnlyOnce.Do(func() {
+		alreadyRan = false
+	})
+	if alreadyRan {
+		return nil
+	}
 	for _, eventConfig := range s.Events {
 		// Assume no 2 EventConfigs have the same combination of:
 		// LogGroupName, LogStreamName, Name.
diff --git a/plugins/inputs/windows_event_log/windows_event_log_test.go b/plugins/inputs/windows_event_log/windows_event_log_test.go
index 069137bab8..e41f6e7646 100644
--- a/plugins/inputs/windows_event_log/windows_event_log_test.go
+++ b/plugins/inputs/windows_event_log/windows_event_log_test.go
@@ -10,6 +10,8 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
 // TestGetStateFilePathGood tests getStateFilePath with good input.
@@ -101,3 +103,21 @@ func TestGetStateFilePathSpecialChars(t *testing.T) {
 		t.Errorf("expected non-nil")
 	}
 }
+
+func TestWindowsDuplicateStart(t *testing.T) {
+	fileStateFolder := filepath.Join(t.TempDir(), "CloudWatchAgentTest")
+	plugin := Plugin{
+		FileStateFolder: fileStateFolder,
+	}
+	ec := EventConfig{
+		LogGroupName:  "My  Group/:::",
+		LogStreamName: "My::Stream//  ",
+		Name:          "System  Event//Log::",
+	}
+	plugin.Events = append(plugin.Events, ec)
+	require.Equal(t, 0, len(plugin.newEvents), "Start should be ran only once so there should be only 1 new event")
+	plugin.Start(nil)
+	require.Equal(t, 1, len(plugin.newEvents), "Start should be ran only once so there should be only 1 new event")
+	plugin.Start(nil)
+	require.Equal(t, 1, len(plugin.newEvents), "Start should be ran only once so there should be only 1 new event")
+}