Winlogbeat windows server event issue

Hello everyone !

I'm having weird issue with winlogbeat.
When I use winlogbeat on Windows 10, after I create a windows user it uses fields such as "", "process.parent.args" etc.
But when I create a user on Windows Server 2019 it never uses these field. Also I don't even receive any "process create/terminate event"
Unfortunately I can't use Detection Rules since these fields does not exists.
Any one knows why ?

Some of the fields that windows 10 has while server 2019 doesn't.