[Filebeat] ETW input - add basic metrics

[andrewkroh]

Proposed commit message

Add input metrics to for ETW.

Remove the very verbose debug message that was in the hot path for
processing each event.

I think more metrics taken from the ETW session itself should be added
separately (e.g. events lost, buffers lost). This lays the ground work needed
to expose those metrics.

Closes #38007

Author checklist

• Is the callback function only ever invoke by a single thread? (This influences where it need to protect against races on the last callback time.)

Example data

[
  {
    "arrival_period": {
      "histogram": {
        "count": 174046,
        "max": 35801500,
        "mean": 51979.00390625,
        "median": 900,
        "min": 0,
        "p75": 2300,
        "p95": 10775,
        "p99": 136950,
        "p999": 35187342.50000056,
        "stddev": 1172792.9385769565
      }
    },
    "discarded_events_total": 0,
    "errors_total": 0,
    "id": "win32k",
    "input": "etw",
    "processing_time": {
      "histogram": {
        "count": 174047,
        "max": 203593000,
        "mean": 461956.8359375,
        "median": 0,
        "min": 0,
        "p75": 0,
        "p95": 512375,
        "p99": 988050,
        "p999": 201688782.50000173,
        "stddev": 7506149.117071189
      }
    },
    "session": "Elastic-Microsoft-Windows-Win32k",
    "received_events_total": 174047,
    "source_lag_time": {
      "histogram": {
        "count": 174047,
        "max": 62549995500,
        "mean": 37557071369.04297,
        "median": 41560344000,
        "min": 960816000,
        "p75": 54243826225,
        "p95": 59757085550,
        "p99": 61976473025,
        "p999": 62548924737.5,
        "stddev": 18237039484.0725
      }
    }
  }
]

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Duration: 134 min 2 sec

❕ Flaky test report

No test was executed to be analysed.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3721e57

History

• 💔 Build #3175 failed 8bc342a
• 💚 Build #3049 succeeded 10e970d

cc @andrewkroh

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[chemamartinez]

LGTM