[winlogbeat] when ingesting evtx file processing stops at 512

[intxgo]

For confirmed bugs, please report:

• Version: 9.1.5
• Operating System: windows
• Discuss Forum URL:
• Steps to Reproduce:

We've obseved that winlogbeat process only 512 events and reports EOL with this config:

winlogbeat.event_logs:
  - name: "C:/test/saved-events.evtx"
    no_more_events: stop

However it process all events from evtx file with this config:

winlogbeat.event_logs:
  - name: "C:/sdh/customer-events.evtx"

or this config:

winlogbeat.event_logs:
  - name: "C:/sdh/customer-events.evtx"
    no_more_events: stop
    batch_read_size: 128

[botelastic]

This issue doesn't have a Team:<team> label.