Help: Can't get Sysmon data parsed correctly. Event module seems broken.

Hey folks, hitting a wall with something that should be working and hoping someone else has been down this road.

I've got Sysmon forwarding events to my Elastic stack (version 8.13), and the ingestion itself is fine. The problem is the parsing. The `event.module` field is showing up as just "sysmon" for everything, but the actual event data (like `event.code` for process creation or network connection) isn't being parsed into the expected ECS fields. For example, I'm not seeing `process.parent.name` or `destination.ip` populated from the Sysmon XML, even though the raw log contains all that detail. It's like the ingest pipeline or the Elastic Agent's integration isn't applying the right dissect or grok patterns.

My configs seem standard. The Elastic Agent has the System and Sysmon integrations added to its policy. I've checked the `logs-sysmon` dataset is active. I even tried creating a custom ingest pipeline to target the `log.file.path` containing "Sysmon", but that feels like a workaround for what should be a supported module.

Has anyone else run into this recently? Did you find a specific field mapping that was missing, or was there a version-specific change in how the Sysmon module processes the event data? I'm especially curious if there's a known issue with certain Sysmon schema versions. Any real-world config snippets or pipeline tweaks that got things lining up would be a huge help!