x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph:…

… set log max_size

There was no check on the tracer log settings, so the max_size was not being
checked for zero. This would result in 100MB log rotation trigger and zero-sized
bodies. There is no validation logic to hook this into in the config for the
fetcher, so calculate it immediately before use.

CHANGELOG.next.asciidoc

@@ -148,6 +148,7 @@ https:/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix bug in Okta entity analytics rate limit logic. {issue}40106[40106] {pull}40267[40267]
 - Fix crashes in the journald input. {pull}40061[40061]
 - Fix order of configuration for EntraID entity analytics provider. {pull}40487[40487]
+- Ensure request bodies are not truncated and logs are rotated before 100MB. {pull}[]
 
 *Heartbeat*
 

x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph/graph.go

@@ -456,7 +456,7 @@ func requestTrace(ctx context.Context, cli *http.Client, cfg graphConf, log *log
  traceLogger := zap.New(core)
 
  const margin = 10e3 // 1OkB ought to be enough room for all the remainder of the trace details.
- maxSize := cfg.Tracer.MaxSize * 1e6
+ maxSize := max(1, cfg.Tracer.MaxSize) * 1e6
  cli.Transport = httplog.NewLoggingRoundTripper(cli.Transport, traceLogger, max(0, maxSize-margin), log)
  return cli
 }