"windows.powershell_operational" not available in Fleet Data Streams tab when relating events are on host Win Server 2012.

[amolnater-qasource]

Kibana version:
Kibana: 8.0.0 Snapshot Cloud environment

Preconditions:

1. Artifacts for 8.0.0 Snapshot Agent should be available.
   Link used: https://snapshots.elastic.co/8.0.0-e9bbbb5f/downloads/beats/elastic-agent/elastic-agent-8.0.0-SNAPSHOT-windows-x86_64.zip

Build Details:

    BUILD: 39872
    COMMIT: 0fe7b9e080c67c43aefdb7ea25d5e90a80cb4ade

3. Agent must be deployed using default policy having Windows integration.

Steps to reproduce:

1. Login to Kibana cloud environment.
2. Navigate to Fleet>Data Streams tab.
3. Go to integration filter and select- windows.
4. Observe that "windows.powershell_operational" dataset logs are not available under Data Streams tab.
5. Navigate to Windows Server 2012 endpoint.
6. Run: Get-WinEvent -ListLog * | where {$_.RecordCount -gt 0} command in PowerShell.
7. Observe that "Microsoft-Windows-Powershell/Operational" events are available.

Reference ticket Id:
#551 (comment)

Actual Result:
"windows.powershell_operational" dataset logs are not available under Data Streams tab when "Microsoft-Windows-Powershell/Operational" events are available for Windows Server 2012.

Expected Result:
"windows.powershell_operational" should be available in Data Streams tab in this case

Screenshots:

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[manishgupta-qasource]

Reviewed & Assigned to @EricDavisX

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[EricDavisX]

I see this is a spin-off of the above linked issue, thank you for the reference link.
@amolnater-qasource we need to know the version of the Integration used during test when we are reporting a 'data' problem with collection. Also, if it works on other Windows host systems please do note this or note whether it has been assessed, so we can follow up if needs be. Thank you.

[fearful-symmetry]

@narph might want to look into this. I looked into it, and wasn't sure if it was an integrations issue, or a config issue.

[amolnater-qasource]

Hi @EricDavisX

Windows Integration version used during testing was v0.3.0

Further, we have shared our observations for Windows 10 host on 8.0 snapshot Kibana cloud build earlier in ticket #551 (comment)

Build details:

BUILD: 39872
COMMIT: 0fe7b9e080c67c43aefdb7ea25d5e90a80cb4ade

Observation :

• "windows.powershell_operational" dataset logs are available on Datstream page for Windows 10 OS host.

Please refer below Screenshot:

Thanks
QAS

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!