How to configure filebeat for AD logs in Cloudwatch

I don't think you can do this with Winlogbeat, as it expects to be able to read directly from the OS event logger. It doesn't have any inputs you can tell it to read from other locations.