chore: Rename windows_eventlog to windows_event_log for consistency

Rename all occurrences of `windows_eventlog` to `windows_event_log`:
- Feature flags in Cargo.toml
- Source directory and module names
- Internal events module
- Configuration type name
- Protocol name
- Documentation URLs
- Checkpoint filename

This ensures consistent naming with underscores between words throughout
the codebase and passes spellcheck validation.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: tot19

Cargo.toml

@@ -502,7 +502,7 @@ docs = ["api", "api-client", "enrichment-tables", "sinks", "sources", "sources-d
 default-cmake = ["api", "api-client", "enrichment-tables", "rdkafka?/cmake_build", "sinks", "sources", "sources-dnstap", "transforms", "unix", "rdkafka?/gssapi-vendored", "secrets"]
 # Default features for *-pc-windows-msvc
 # TODO: Enable SASL https://github.com/vectordotdev/vector/pull/3081#issuecomment-659298042
-default-msvc = ["api", "api-client", "enrichment-tables", "rdkafka?/cmake_build", "sinks", "sources", "sources-windows_eventlog", "transforms", "secrets"]
+default-msvc = ["api", "api-client", "enrichment-tables", "rdkafka?/cmake_build", "sinks", "sources", "sources-windows_event_log", "transforms", "secrets"]
 default-musl = ["api", "api-client", "enrichment-tables", "rdkafka?/cmake_build", "sinks", "sources", "sources-dnstap", "transforms", "unix", "rdkafka?/gssapi-vendored", "secrets"]
 default-no-api-client = ["api", "enrichment-tables", "sinks", "sources", "sources-dnstap", "transforms", "unix", "rdkafka?/gssapi-vendored", "secrets"]
 default-no-vrl-cli = ["api", "sinks", "sources", "sources-dnstap", "transforms", "unix", "rdkafka?/gssapi-vendored", "secrets"]
@@ -627,7 +627,7 @@ sources-logs = [
   "sources-syslog",
   "sources-vector",
   "sources-websocket",
-  "sources-windows_eventlog",
+  "sources-windows_event_log",
 ]
 sources-metrics = [
   "dep:prost",
@@ -714,8 +714,8 @@ sources-utils-net-tcp = ["listenfd", "dep:ipnet"]
 sources-utils-net-udp = ["listenfd"]
 sources-utils-net-unix = []
 sources-websocket = ["dep:tokio-tungstenite"]
-sources-windows_eventlog = ["dep:windows", "dep:quick-xml", "dep:governor"]
-sources-windows_eventlog-integration-tests = ["sources-windows_eventlog"]
+sources-windows_event_log = ["dep:windows", "dep:quick-xml", "dep:governor"]
+sources-windows_event_log-integration-tests = ["sources-windows_event_log"]
 
 sources-vector = ["dep:prost", "dep:tonic", "protobuf-build"]
 

changelog.d/windows_eventlog_source.feature.md renamed to changelog.d/windows_event_log_source.feature.md

@@ -1,14 +1,14 @@
-The `windows_eventlog` source allows collecting logs from Windows Event Log channels using the Windows Event Log API.
+The `windows_event_log` source allows collecting logs from Windows Event Log channels using the Windows Event Log API.
 
 This Windows-specific source uses event-driven subscriptions to stream events in real-time with comprehensive security validation, configurable field filtering, and support for XPath event queries. Key features include:
 
 - Support for multiple channels (System, Application, Security, and 140+ specialized channels)
-- Real-time event-driven subscriptions using EvtSubscribe API
+- Real-time event-driven subscriptions using the native Windows Event Log subscription API
 - XPath query filtering for selective event collection
 - Checkpoint persistence for reliable resumption after restarts (similar to journald)
 - End-to-end acknowledgment support for at-least-once delivery guarantees
 - Configurable rate limiting to prevent overwhelming downstream systems
-- Configurable field truncation for storage optimization (Winlogbeat-compatible)
+- Configurable field truncation for storage optimization
 - Enhanced provider name extraction using proper XML parsing
 - Support for large events (up to 10MB)
 - Security hardening against XPath injection, resource exhaustion, and memory leaks
@@ -17,7 +17,7 @@ This Windows-specific source uses event-driven subscriptions to stream events in
 
 New configuration options:
 - `events_per_second`: Rate limit event processing (0 = unlimited)
-- `max_event_data_length`: Truncate event data values (0 = no truncation, Winlogbeat default)
+- `max_event_data_length`: Truncate event data values (0 = no truncation)
 - `data_dir`: Directory for checkpoint persistence
 
 Note: Wildcard channel patterns (e.g., `Microsoft-Windows-*`) are not supported. Specify exact channel names.

src/internal_events/mod.rs

@@ -141,8 +141,8 @@ mod websocket;
 mod websocket_server;
 #[cfg(feature = "transforms-window")]
 mod window;
-#[cfg(all(windows, feature = "sources-windows_eventlog"))]
-mod windows_eventlog;
+#[cfg(all(windows, feature = "sources-windows_event_log"))]
+mod windows_event_log;
 
 #[cfg(any(
     feature = "sources-file",
@@ -293,8 +293,8 @@ pub(crate) use self::websocket_server::*;
 pub(crate) use self::window::*;
 #[cfg(windows)]
 pub(crate) use self::windows::*;
-#[cfg(all(windows, feature = "sources-windows_eventlog"))]
-pub(crate) use self::windows_eventlog::*;
+#[cfg(all(windows, feature = "sources-windows_event_log"))]
+pub(crate) use self::windows_event_log::*;
 pub use self::{
     adaptive_concurrency::*, batch::*, common::*, conditions::*, encoding_transcode::*,
     heartbeat::*, http::*, open::*, process::*, socket::*, tcp::*, template::*, udp::*,

src/internal_events/windows_eventlog.rs renamed to src/internal_events/windows_event_log.rs

@@ -94,8 +94,8 @@ pub mod syslog;
 pub mod vector;
 #[cfg(feature = "sources-websocket")]
 pub mod websocket;
-#[cfg(all(windows, feature = "sources-windows_eventlog"))]
-pub mod windows_eventlog;
+#[cfg(all(windows, feature = "sources-windows_event_log"))]
+pub mod windows_event_log;
 
 pub mod util;
 

src/sources/mod.rs

@@ -14,7 +14,7 @@ use tracing::{debug, error, info, warn};
 
 use super::error::WindowsEventLogError;
 
-const CHECKPOINT_FILENAME: &str = "windows_eventlog_checkpoints.json";
+const CHECKPOINT_FILENAME: &str = "windows_event_log_checkpoints.json";
 
 /// Checkpoint data for a single Windows Event Log channel
 ///

src/sources/windows_eventlog/bookmark.rs renamed to src/sources/windows_event_log/bookmark.rs

@@ -15,9 +15,9 @@ const MAX_CONNECTION_TIMEOUT_SECS: u64 = 3600;
 const MAX_EVENT_TIMEOUT_MS: u64 = 60000;
 const MAX_BATCH_SIZE: u32 = 10000;
 
-/// Configuration for the `windows_eventlog` source.
+/// Configuration for the `windows_event_log` source.
 #[configurable_component(source(
-    "windows_eventlog",
+    "windows_event_log",
     "Collect logs from Windows Event Log channels using the Windows Event Log API."
 ))]
 #[derive(Clone, Debug)]

src/sources/windows_eventlog/checkpoint.rs renamed to src/sources/windows_event_log/checkpoint.rs

@@ -1,4 +1,4 @@
-#![cfg(feature = "sources-windows_eventlog-integration-tests")]
+#![cfg(feature = "sources-windows_event_log-integration-tests")]
 #![cfg(test)]
 
 use std::time::Duration;