[Windows] Custom Event Channel support #317
Description
The Windows/System integrations currently support Application, System, Security, Sysmon and PowerShell events. To complete our winlogbeat migration, we need to ensure users can ingest events from channels outside of our supported channels. Example: Applications and Services Logs \Microsoft\Windows\Applocker\EXE and DLL.
Based on this design doc, our initial plan involved adding Custom Windows Events to the existing Windows integration, but given that multi-input is not currently a priority, this may not be feasible. This workaround may be an option: elastic/kibana#82783
If multi-input is a non-runner, the preference is to provide a Custom Windows Event integration whereby a user adds a single event channel per custom integration.
Acceptance Criteria
- Users can ingest Windows Events from custom channels (Windows Integration vs Custom Windows Integration TBD)
- Users can specify the ingest node pipeline to write to.