Minor update, now i'm seeing this in the log.json:
{"k":"filebeat::logs::native::107741184-128951-4039310828","v":{"id":"native::107741184-128951-4039310828","offset":1401071,"ttl":-1,"identifier_name":"native","prev_id":"","source":"C:\inetpub\logs\LogFiles\W3SVC9\u_ex220105_x.log","timestamp":[258391817160,1641374659],"type":"log","FileStateOS":{"idxlo":128951,"vol":4039310828,"idxhi":107741184}}}