Winlogbeat drop_event.when.not.or: not working - Sidecar Version 1.5, Graylog 5.2

Graylog Central (peer support)
,
3

Hello @gsmith , there were not errors or warnings.
I tried around and it works now, but seems strange as it is nowhere documented.

For sidecar Version 1.4 (Winlogbeat 7.11.1) to use drop_event.when.not.or:

- equals.winlog.event_id: 4616
- equals.winlog.event_id: 4624

For sidecar Version 1.5 (Winlogbeat 8.9.0), I nedd to put the windows event id into qoutes.

- equals.winlog.event_id: "4616"
- equals.winlog.event_id: "4624"

Both methods are not working for the other one around. Does anyone else experienced this?