chore(sources): Remove wildcard expansion and message field truncation from Windows Event Log source

- Remove wildcard channel pattern expansion (caused heap corruption with many channels)
- Add config validation to explicitly reject wildcard patterns (*, ?, [) with clear error message
- Remove max_message_field_length config option (unnecessary complexity)
- Clean up unused error variants and helper functions

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: tot19

changelog.d/windows_eventlog_source.feature.md

@@ -17,5 +17,4 @@ This Windows-specific source uses event-driven subscriptions to stream events in
 New configuration options:
 - `events_per_second`: Rate limit event processing (0 = unlimited)
 - `max_event_data_length`: Truncate event data values (0 = no truncation, Winlogbeat default)
-- `max_message_field_length`: Truncate message summary field (0 = no truncation, Winlogbeat default)
 - `data_dir`: Directory for checkpoint persistence

src/sources/windows_eventlog/config.rs

@@ -157,16 +157,6 @@ pub struct WindowsEventLogConfig {
     #[configurable(metadata(docs::examples = 4096))]
     pub max_event_data_length: usize,
 
-    /// Maximum length for message summary field.
-    ///
-    /// The message field contains a human-readable summary with event data samples.
-    /// Individual event data values in the message will be truncated to this length.
-    /// Set to 0 for no limit (matches Winlogbeat behavior).
-    #[serde(default = "default_max_message_field_length")]
-    #[configurable(metadata(docs::examples = 256))]
-    #[configurable(metadata(docs::examples = 1024))]
-    pub max_message_field_length: usize,
-
     /// Controls how acknowledgements are handled for this source.
     ///
     /// When enabled, the source will wait for downstream sinks to acknowledge
@@ -269,7 +259,6 @@ impl Default for WindowsEventLogConfig {
             data_dir: None,
             events_per_second: default_events_per_second(),
             max_event_data_length: default_max_event_data_length(),
-            max_message_field_length: default_max_message_field_length(),
             acknowledgements: Default::default(),
         }
     }
@@ -328,11 +317,20 @@ impl WindowsEventLogConfig {
                 .into());
             }
 
+            // Reject wildcard patterns - they cause heap corruption issues with many channels
+            if is_channel_pattern(channel) {
+                return Err(format!(
+                    "Channel name '{}' contains wildcard characters (*, ?, [). \
+                     Wildcard patterns are not supported. Please specify exact channel names.",
+                    channel
+                )
+                .into());
+            }
+
             // Validate channel name contains only safe characters
-            // Allow *, ?, [ for glob pattern matching (e.g., "Microsoft-Windows-*")
             if !channel
                 .chars()
-                .all(|c| c.is_ascii_alphanumeric() || "-_ /\\*?[]".contains(c))
+                .all(|c| c.is_ascii_alphanumeric() || "-_ /\\".contains(c))
             {
                 return Err(
                     format!("Channel name '{}' contains invalid characters", channel).into(),
@@ -556,10 +554,6 @@ const fn default_max_event_data_length() -> usize {
     0 // 0 means no truncation (matches Winlogbeat)
 }
 
-const fn default_max_message_field_length() -> usize {
-    0 // 0 means no truncation (matches Winlogbeat)
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -647,7 +641,6 @@ mod tests {
             data_dir: PathBuf::from("/test/data"),
             events_per_second: 1000,
             max_event_data_length: 0,
-            max_message_field_length: 0,
             acknowledgements: SourceAcknowledgementsConfig::from(true),
         };
 
@@ -691,23 +684,35 @@ mod tests {
     }
 
     #[test]
-    fn test_config_validation_allows_wildcards() {
+    fn test_config_validation_rejects_wildcards() {
         let mut config = WindowsEventLogConfig::default();
 
-        // Wildcard patterns should be allowed in channel names
-        config.channels = vec![
-            "System".to_string(),
-            "Microsoft-Windows-*".to_string(),
-            "Microsoft-Windows-Sysmon/*".to_string(),
-        ];
-        assert!(config.validate().is_ok());
+        // Asterisk wildcard should be rejected
+        config.channels = vec!["Microsoft-Windows-*".to_string()];
+        let err = config.validate().unwrap_err();
+        assert!(err.to_string().contains("wildcard"));
 
-        // Single character wildcards should work
+        // Single character wildcards should be rejected
         config.channels = vec!["System?".to_string()];
-        assert!(config.validate().is_ok());
+        let err = config.validate().unwrap_err();
+        assert!(err.to_string().contains("wildcard"));
 
-        // Character classes should work
+        // Character classes should be rejected
         config.channels = vec!["[Ss]ystem".to_string()];
+        let err = config.validate().unwrap_err();
+        assert!(err.to_string().contains("wildcard"));
+
+        // Mixed valid and wildcard should be rejected
+        config.channels = vec!["System".to_string(), "Microsoft-Windows-*".to_string()];
+        let err = config.validate().unwrap_err();
+        assert!(err.to_string().contains("wildcard"));
+
+        // Exact channel names should still work
+        config.channels = vec![
+            "System".to_string(),
+            "Application".to_string(),
+            "Microsoft-Windows-Sysmon/Operational".to_string(),
+        ];
         assert!(config.validate().is_ok());
     }
 }

src/sources/windows_eventlog/error.rs

@@ -59,17 +59,6 @@ pub enum WindowsEventLogError {
     #[snafu(display("Channel '{}' not found", channel))]
     ChannelNotFoundError { channel: String },
 
-    #[snafu(display("Failed to enumerate event log channels: {}", source))]
-    ChannelEnumerationError {
-        #[cfg(windows)]
-        source: windows::core::Error,
-        #[cfg(not(windows))]
-        source: Box<dyn std::error::Error + Send + Sync>,
-    },
-
-    #[snafu(display("No channels matched pattern '{}'", pattern))]
-    NoChannelsMatchedPattern { pattern: String },
-
     #[snafu(display("I/O error: {}", source))]
     IoError { source: std::io::Error },
 
@@ -146,8 +135,6 @@ impl WindowsEventLogError {
             | Self::SubscriptionError { .. }
             | Self::AccessDeniedError { .. }
             | Self::ChannelNotFoundError { .. }
-            | Self::ChannelEnumerationError { .. }
-            | Self::NoChannelsMatchedPattern { .. }
             | Self::InvalidXPathQuery { .. }
             | Self::ConfigError { .. }
             | Self::CreateRenderContextError { .. }