We are experiencing an issue where Winlogbeat successfully ingests all Windows log channels (Application/System/Security/Sysmon) except for one very specific event type:
Microsoft-Windows-Winlogon — Event ID 6000 ("The winlogon notification subscriber was unavailable to handle a notification event")
This event appears normally in the Windows Event Viewer under Application, but Winlogbeat never forwards it to Graylog
