I'm trying to collect the full windows event messages, all the fields plus the full message/rendered message (the view you see in windows)

It seems like if use the json method I get that message at least sometimes but then really crucial information like username domain etc are buried in the properties field, and if I use xml then I get all the fields with names etc, but I don't get that rendered message at all.

I'm used to working with winlogbeat and nxlog and this is pretty standard to do in those, but is there a way to do this in the edge agent?