Add fields to winlogbeat events

Elastic Stack Beats
4

For add_fields it would be a series of processors:

processors:
  - add_fields:
      when:
        event_data.Status: "0xc000006d"
      fields:
        event_data.Status_Description: This is either due to a bad username or authentication information.
      target: ""
  - add_fields:
      when:
        event_data.Status: "0x123"
      fields:
        event_data.Status_Description: One two three
      target: ""