Agent Health Metric for Windows Events Filtering

[Paamicky]

Description of the issue

Currently, there is no way to know the number of customers using the windows event filtering in the Agent's configuration. This PR address this issue by adding the feature as part of the user-agent string for detection during API calls to CloudWatch.

NOTE: This PR is on hold for updates on Agent Health Metrics

Description of changes

• Detection logic for when a particular filter is used in the agent json configuration file.
• Filter flag is added to the user-agent input string and recorded during API calls to CloudWatch.

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tests

Filter flags been added to the user-agent input string.

POST / HTTP/1.1
Host: logs.us-east-2.amazonaws.com
User-Agent: CWAgent/1.300056.1-7-g037fe7f6-untracked (go1.24.4; windows; amd64) ID/ad6e9ec7-f161-494a-87ba-b546b420dadd inputs:(nop run_as_user windows_event_filters windows_event_ids windows_event_levels windows_event_log) outputs:(cloudwatchlogs nop) aws-sdk-go/1.48.6 (go1.24.4; windows; amd64) exec-env/EC2
Content-Length: 251
Authorization: AWS4-HMAC-SHA256 Credential=ASIAS3VO6ZR4K5ECXB6Q/20250721/us-east-2/logs/aws4_request, SignedHeaders=content-encoding;content-length;content-type;host;x-amz-agent-stats;x-amz-date;x-amz-security-token;x-amz-target, Signature=eadcd0c0c03140c8083dc4089b4abe41090bc11fd29a120b212fc222dd3438de
Content-Encoding: gzip
Content-Type: application/x-amz-json-1.1
X-Amz-Agent-Stats: "cpu":17.8,"mem":61575168,"th":15,"ric":0,"rt":"EC2M","m":"EC2"
X-Amz-Date: 20250721T135521Z
X-Amz-Target: Logs_20140328.PutLogEvents
Accept-Encoding: gzip�

Dashboard showing usage of filters: Team Dashboard

Requirements

Before commiting your code, please do the following steps.

1. Run make fmt and make fmt-sh
2. Run make lint

---

Integration Tests

To run integration tests against this PR, add the ready for testing label.

The base branch was changed.

[github-actions]

This PR was marked stale due to lack of activity.

[github-actions]

This PR was marked stale due to lack of activity.