Graylog, WinLogBeat & Forwarded Events

Do tell me if this isn't the right sub, because I am not entirely sure.

I'm working on PoC for centralized logging and set-up a Windows server as an Event Collector from all domain controllers.

Part 1 of my config was getting the events I want on the Windows device, an all looks fine. Part two was installing WinLogBeats on the WEC: also looks fine. The third was setting up the connection with Graylog: also fine.

But. Of course there's a but, otherwise I wouldn't post here. The source in Graylog is always the event collector, and not the actualy DC the event comes from. I found a parameter forwarded for winlogbeat …

winlogbeat.event_logs: - name: ForwardedEvents forwarded: true 

… but that does not seem to have any influence on the source.

event_logs.forwarded

A boolean flag to indicate that the log contains only events collected from remote hosts using the Windows Event Collector. The value defaults to true for the ForwardedEvents log and false for any other log. This option is only available on operating systems supporting the Windows Event Log API (Microsoft Windows Vista and newer).

This setting allows WinLogBeat to optimize reads for forwarded events that are already rendered. When the value is true Winlogbeat does not attempt to render the event using message files from the host computer. The Windows Event Collector subscription should be configured to use the "RenderedText" format (this is the default) to ensure that the events are distributed with messages and descriptions.

If I would install WinLogBeat on every DC, this problem would be solved, but I like to use a WEC so I can work clientless.

Thank you for your advice.