Enhance CloudWatch source to process events page-by-page instead of waiting for all logs to be fetched

[ParthaI]

Example query results

Results

> select event_name, event_id, event_time from aws_cloudtrail_log
+-------------------------------------------+--------------------------------------+---------------------+
| event_name                                | event_id                             | event_time          |
+-------------------------------------------+--------------------------------------+---------------------+
| AssumeRole                                | 026680c3-17de-3410-8ea0-ac3c81101a8f | 2025-09-04 14:09:35 |
| AssumeRole                                | 51687b87-b629-3543-9e23-b0f956517bba | 2025-09-04 18:43:49 |
| GetBucketAcl                              | f46b463e-2f8d-36b7-8f1f-e69d180eac4a | 2025-09-04 09:26:52 |
| AssumeRole                                | aea397f0-6ead-3cb5-bed1-54bcad91b238 | 2025-09-04 09:27:04 |
| GetAccessKeyLastUsed                      | ae138198-0a8d-4c55-ac63-395fe4c92634 | 2025-09-04 04:47:34 |
| AssumeRole                                | d1b37c20-2984-334e-b23e-5c2a695617f5 | 2025-09-04 04:48:33 |
| AssumeRole                                | 0154734a-3bab-36b6-9445-53af750366a8 | 2025-09-04 04:48:49 |

[Copilot]

Pull Request Overview

This PR refactors the CloudWatch log group source to process events incrementally as they are fetched from the API, rather than collecting all events first and then processing them. This approach improves memory efficiency and reduces latency by starting event processing immediately.

• Introduces a new processLogEvents method to handle event processing logic
• Modifies filterLogEvents to process events page-by-page instead of accumulating all events
• Moves event processing logic from the main collection loop into dedicated processing function

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[github-actions]

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.