I’m collecting logs from Windows Serwer 2012 R2 using graylog collector sidecar with winlogbeat, and I have issues with logs language. The system was installed as Polish (my language) but later we changed language to English, now everything is in English except messages sent by winlogbeat run by collector (which is run as a service), those are in Polish. BUT if I run winlogbeat manually from the cmd shell with the same config messages I collect are in English.
TL;DR: winlogbeat run by collector sends event log messages in Polish, winlogbeats run by hand sends messages in English (desired)
(Don’t know if it’s right category, mods please move accordingly)