x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph:…

… set log max_size (#40494)

There was no check on the tracer log settings, so the max_size was not being
checked for zero. This would result in 100MB log rotation trigger and zero-sized
bodies. There is no validation logic to hook this into in the config for the
fetcher, so calculate it immediately before use.

CHANGELOG.next.asciidoc

@@ -148,6 +148,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix bug in Okta entity analytics rate limit logic. {issue}40106[40106] {pull}40267[40267]
 - Fix crashes in the journald input. {pull}40061[40061]
 - Fix order of configuration for EntraID entity analytics provider. {pull}40487[40487]
+- Ensure Entra ID request bodies are not truncated and trace logs are rotated before 100MB. {pull}40494[40494]
 
 *Heartbeat*
 

x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph/graph.go

@@ -456,7 +456,7 @@ func requestTrace(ctx context.Context, cli *http.Client, cfg graphConf, log *log
 	traceLogger := zap.New(core)
 
 	const margin = 10e3 // 1OkB ought to be enough room for all the remainder of the trace details.
-	maxSize := cfg.Tracer.MaxSize * 1e6
+	maxSize := max(1, cfg.Tracer.MaxSize) * 1e6
 	cli.Transport = httplog.NewLoggingRoundTripper(cli.Transport, traceLogger, max(0, maxSize-margin), log)
 	return cli
 }