Refactor Windows Filter flags

extension/agenthealth/handler/useragent/useragent.go

@@ -33,9 +33,6 @@ const (
 	flagEnhancedContainerInsights = "enhanced_container_insights"
 	flagSELinux                   = "selinux"
 	flagROSA                      = "rosa"
-	FlagWindowsEventIDs           = "win_event_ids"
-	FlagWindowsEventFilters       = "win_event_filters"
-	FlagWindowsEventLevels        = "win_event_levels"
 	separator                     = " "
 
 	typeInputs     = "inputs"
@@ -85,6 +82,7 @@ func (ua *userAgent) SetComponents(otelCfg *otelcol.Config, telegrafCfg *telegra
 
 	for _, input := range telegrafCfg.Inputs {
 		ua.inputs.Add(input.Config.Name)
+		ua.setWindowsEventLogFeatureFlags(input)
 	}
 
 	for _, output := range telegrafCfg.Outputs {

extension/agenthealth/handler/useragent/useragent_notwindows.go

@@ -0,0 +1,14 @@
+//go:build !windows
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: MIT
+
+package useragent
+
+import (
+	"github.com/influxdata/telegraf/models"
+)
+
+func (ua *userAgent) setWindowsEventLogFeatureFlags(_ *models.RunningInput) {
+	// No-op on non-Windows platforms
+}

extension/agenthealth/handler/useragent/useragent_windows.go

@@ -0,0 +1,37 @@
+//go:build windows
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: MIT
+
+package useragent
+
+import (
+	"github.com/influxdata/telegraf/models"
+
+	"github.com/aws/amazon-cloudwatch-agent/plugins/inputs/windows_event_log"
+)
+
+const (
+	flagWindowsEventIDs     = "win_event_ids"
+	flagWindowsEventFilters = "win_event_filters"
+	flagWindowsEventLevels  = "win_event_levels"
+	pluginWindowsEventLog   = "windows_event_log"
+)
+
+func (ua *userAgent) setWindowsEventLogFeatureFlags(input *models.RunningInput) {
+	if input.Config.Name == pluginWindowsEventLog {
+		if plugin, ok := input.Input.(*windows_event_log.Plugin); ok {
+			for _, eventConfig := range plugin.Events {
+				if len(eventConfig.EventIDs) > 0 {
+					ua.feature.Add(flagWindowsEventIDs)
+				}
+				if len(eventConfig.Filters) > 0 {
+					ua.feature.Add(flagWindowsEventFilters)
+				}
+				if len(eventConfig.Levels) > 0 {
+					ua.feature.Add(flagWindowsEventLevels)
+				}
+			}
+		}
+	}
+}

extension/agenthealth/handler/useragent/useragent_windows_test.go

@@ -0,0 +1,103 @@
+//go:build windows
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: MIT
+
+package useragent
+
+import (
+	"testing"
+
+	"github.com/influxdata/telegraf/models"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/aws/amazon-cloudwatch-agent/plugins/inputs/windows_event_log"
+	"github.com/aws/amazon-cloudwatch-agent/plugins/inputs/windows_event_log/wineventlog"
+)
+
+func TestSetWindowsEventLogFeatureFlags(t *testing.T) {
+	tests := []struct {
+		name          string
+		inputName     string
+		plugin        *windows_event_log.Plugin
+		expectedFlags []string
+	}{
+		{
+			name:          "non-windows input",
+			inputName:     "cpu",
+			plugin:        &windows_event_log.Plugin{},
+			expectedFlags: []string{},
+		},
+		{
+			name:      "no features",
+			inputName: pluginWindowsEventLog,
+			plugin: &windows_event_log.Plugin{
+				Events: []windows_event_log.EventConfig{{Name: "System"}},
+			},
+			expectedFlags: []string{},
+		},
+		{
+			name:      "win_event_ids",
+			inputName: pluginWindowsEventLog,
+			plugin: &windows_event_log.Plugin{
+				Events: []windows_event_log.EventConfig{{
+					Name:     "System",
+					EventIDs: []int{1000, 1001},
+				}},
+			},
+			expectedFlags: []string{flagWindowsEventIDs},
+		},
+		{
+			name:      "win_event_filters",
+			inputName: pluginWindowsEventLog,
+			plugin: &windows_event_log.Plugin{
+				Events: []windows_event_log.EventConfig{{
+					Name:    "System",
+					Filters: []*wineventlog.EventFilter{{Expression: "test"}},
+				}},
+			},
+			expectedFlags: []string{flagWindowsEventFilters},
+		},
+		{
+			name:      "win_event_levels",
+			inputName: pluginWindowsEventLog,
+			plugin: &windows_event_log.Plugin{
+				Events: []windows_event_log.EventConfig{{
+					Name:   "System",
+					Levels: []string{"ERROR", "WARNING"},
+				}},
+			},
+			expectedFlags: []string{flagWindowsEventLevels},
+		},
+		{
+			name:      "all flags",
+			inputName: pluginWindowsEventLog,
+			plugin: &windows_event_log.Plugin{
+				Events: []windows_event_log.EventConfig{{
+					Name:     "System",
+					EventIDs: []int{1000},
+					Filters:  []*wineventlog.EventFilter{{Expression: "test"}},
+					Levels:   []string{"ERROR"},
+				}},
+			},
+			expectedFlags: []string{flagWindowsEventIDs, flagWindowsEventFilters, flagWindowsEventLevels},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ua := newUserAgent()
+			input := &models.RunningInput{
+				Config: &models.InputConfig{Name: tt.inputName},
+				Input:  tt.plugin,
+			}
+
+			ua.setWindowsEventLogFeatureFlags(input)
+
+			for _, flag := range tt.expectedFlags {
+				assert.Contains(t, ua.feature, flag)
+			}
+			assert.Len(t, ua.feature, len(tt.expectedFlags))
+		})
+	}
+}

plugins/inputs/windows_event_log/windows_event_log.go

@@ -15,7 +15,6 @@ import (
 	"github.com/influxdata/telegraf"
 	"github.com/influxdata/telegraf/plugins/inputs"
 
-	"github.com/aws/amazon-cloudwatch-agent/extension/agenthealth/handler/useragent"
 	"github.com/aws/amazon-cloudwatch-agent/internal/logscommon"
 	"github.com/aws/amazon-cloudwatch-agent/internal/state"
 	"github.com/aws/amazon-cloudwatch-agent/logs"
@@ -93,7 +92,6 @@ func (s *Plugin) Start(acc telegraf.Accumulator) error {
 		return nil
 	}
 
-	s.detectFeatures()
 	monitor := newServiceMonitor()
 	for _, eventConfig := range s.Events {
 		// Assume no 2 EventConfigs have the same combination of:
@@ -158,18 +156,3 @@ func (s *Plugin) Stop() {
 func init() {
 	inputs.Add("windows_event_log", func() telegraf.Input { return &Plugin{} })
 }
-func (s *Plugin) detectFeatures() {
-	if ua := useragent.Get(); ua != nil {
-		for _, eventConfig := range s.Events {
-			if len(eventConfig.EventIDs) > 0 {
-				ua.AddFeatureFlags(useragent.FlagWindowsEventIDs)
-			}
-			if len(eventConfig.Filters) > 0 {
-				ua.AddFeatureFlags(useragent.FlagWindowsEventFilters)
-			}
-			if len(eventConfig.Levels) > 0 {
-				ua.AddFeatureFlags(useragent.FlagWindowsEventLevels)
-			}
-		}
-	}
-}

plugins/inputs/windows_event_log/windows_event_log_test.go

@@ -13,9 +13,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	"github.com/aws/amazon-cloudwatch-agent/extension/agenthealth/handler/useragent"
-	"github.com/aws/amazon-cloudwatch-agent/plugins/inputs/windows_event_log/wineventlog"
 )
 
 // TestGetStateFilePathGood tests getStateFilePath with good input.
@@ -108,40 +105,3 @@ func TestWindowsDuplicateStart(t *testing.T) {
 	plugin.Start(nil)
 	require.Equal(t, 1, len(plugin.newEvents), "Start should be ran only once so there should be only 1 new event")
 }
-
-func TestDetectFeatures(t *testing.T) {
-	plugin := &Plugin{
-		Events: []EventConfig{
-			{
-				EventIDs: []int{1000, 1001},
-			},
-			{
-				Filters: []*wineventlog.EventFilter{{Expression: "test"}},
-				Levels:  []string{"ERROR"},
-			},
-		},
-	}
-
-	ua := useragent.Get()
-	plugin.detectFeatures()
-
-	header := ua.Header(true)
-	assert.Contains(t, header, useragent.FlagWindowsEventIDs)
-	assert.Contains(t, header, useragent.FlagWindowsEventFilters)
-	assert.Contains(t, header, useragent.FlagWindowsEventLevels)
-
-	// Test that only configured features are detected
-	plugin = &Plugin{
-		Events: []EventConfig{{
-			EventIDs: []int{1000},
-		}},
-	}
-	ua = useragent.Get()
-	ua.Reset()
-	plugin.detectFeatures()
-
-	header = ua.Header(true)
-	assert.Contains(t, header, useragent.FlagWindowsEventIDs)
-	assert.NotContains(t, header, useragent.FlagWindowsEventFilters)
-	assert.NotContains(t, header, useragent.FlagWindowsEventLevels)
-}