Configure  "eventlog[System,,,,,,skip]" key, add a "Discard unchanged with heartbeat" preprocessing.

Observe how windows specific columns (Local time, Source, Severity) being lost and "Event ID" column is populated by zeroes.

It happens because of the preprocessing rule, but it should not happen this way.
See screenshots.