in_winevtlog: Make configurable for the size of collecting threshold …

…per a cycle

Previously, I had chosen to restrict with the threshold to prevent
unlimited subscribing per a cycle.
This should cause flood of memory comsumptions but it depends on the
amound of the channels of Windows EventLog.
Nowadays, this plugin is getting widely used.
Also, in the fluent community slack, there is a request to make to be
able to configure for this threshold per a cycle.

To prevent slowing down for the subscribe the channels,
it won't de able to set up below 512KiB with the newly introduced
parameter.

Signed-off-by: Hiroshi Hatake <[email protected]>

plugins/in_winevtlog/in_winevtlog.c

@@ -37,6 +37,7 @@ static int in_winevtlog_init(struct flb_input_instance *in,
                              struct flb_config *config, void *data)
 {
     int ret;
+    int64_t threshold_size;
     const char *tmp;
     int read_existing_events = FLB_FALSE;
     struct mk_list *head;
@@ -70,6 +71,16 @@ static int in_winevtlog_init(struct flb_input_instance *in,
 
     /* Set up total reading size threshold */
     ctx->total_size_threshold = DEFAULT_THRESHOLD_SIZE;
+    tmp = flb_input_get_property("threshold_size", in);
+    if (tmp != NULL) {
+        threshold_size = flb_utils_size_to_bytes(tmp);
+        if (threshold_size > DEFAULT_THRESHOLD_SIZE) {
+            ctx->total_size_threshold = (unsigned int) threshold_size;
+            flb_plg_debug(ctx->ins,
+                          "threshold size is changed to %" PRId64 "KB",
+                          threshold_size / 1000);
+        }
+    }
 
     /* Open channels */
     tmp = flb_input_get_property("channels", in);
@@ -261,6 +272,11 @@ static struct flb_config_map config_map[] = {
       0, FLB_TRUE, offsetof(struct winevtlog_config, event_query),
       "Specify XML query for filtering events"
     },
+    {
+      FLB_CONFIG_MAP_STR, "threshold_size", NULL,
+      0, FLB_TRUE, 0,
+      "Specify threshold size for collecting Windows EventLog per a cycle"
+    },
     /* EOF */
     {0}
 };