Elastic Agent on Windows - can't get syslog data sources working - is it just me?

Hello!

I've been using Elastic Agents on Windows with numerous integrations (security/event logs/O365), however I just can't get any integration that's syslog based (Sonicwall, Fortigate, Sophos) to work through a Windows based Elastic Agent.

I can confirm syslog traffic is making it to my host, so it's not firewall related (even tried turning the firewall off) - wireshark shows that the logs are arriving to the appropriate port on my hosts, however when I set up an integration on an agent, the logs are never picked up. I can make this work with a standard filebeat, but when I bring in the Elastic Agent (which is technically just managing filebeat under the hood) nothing happens.

I'm running this in Elastic Cloud and haven't gotten anywhere with support. I can see my elastic agent listening on the appropriate port with netstat, and I can see the agent is running, but it never does anything with the logs. At this point I'm stumped. Has anyone gotten this working or can think of something I might be missing?