[event_viewer] Improve comments in example configuration

[olivielpeau]

Linked to DataDog/documentation#442 and https://github.com/DataDog/dogweb/pull/8622

Closes #1439

[degemer]

Since you're updating the example, could you also add these options https://github.com/DataDog/dd-agent/blob/master/checks.d/win32_event_log.py#L30-L32 (there is already user, but it is in the middle, not its right place). It shouldn't be used often, but it's still weird that it's not there.

One other thing: could you update the format to have something similar to https://github.com/DataDog/dd-agent/blob/master/conf.d/disk.yaml.default, ie the description of the option and under an example ? (although we should keep both basic example)

Thanks for the precisions you added ! 🍰

[olivielpeau]

Thanks @degemer for your review! I hadn't realized how outdated the config file was so I've almost completely rewritten it, could you have a look now?

[degemer]

Way way way better ! 👏
Some last remarks:

• usually we write the default file so that users just have to uncomment lines and set the correct parameter: do you think you can do it ? (related to next remark)
• from the example yaml, all parameters are optional: does it mean that if I write

instances:
  - random: iamramdom

it will collect all events ? I don't think we want this anyway, do you know if there is a parameter always used ?

• I think we either dropped already notify or are deprecating it (it's not in the API docs), so could you remove it from the example ?

[olivielpeau]

All the parameters are optional indeed, but we can probably set a default value on the log file that's captured (System could be a good candidate).

[olivielpeau]

I've removed the notify section, but after some further digging I haven't been able to find a sane default on any of the parameters that would make the check capture only specific interesting events.

To avoid sending thousands of events in case an instance's filters aren't specific enough, we could:

• In the config file, set a fully-defined default instance that would capture Critical and Error on the System LogFile
• Limit the number of events that the integration captures.

I'm open to suggestions if you think there's a better solution :)

[olivielpeau]

Discussed with @degemer, we'll leave an uncommented dash in the example yaml as it doesn't define a valid instance by itself (so the config file doesn't collect all the events as-is).

Merging