Hi!
In order to collect powershell logs by winlogbeat 6.8, I tried to change config file just adding 2 rows under
winlogbeat.event_logs:
-name: Windows Powershell
-name: Microsoft-Windows-Powershell/Operational
Unfortunately, as a result, I see powershell logs only from system. Has anybody faced with this issue?