[7.17](backport #35049) [Winlogbeat] Document 21 Event ID clause limi…

…t under certain situations (#35053)

- Added note in documentation about a situation where the event ID clause
limit is lower than the claimed 22 clause limit.

(cherry picked from commit b2a3aba)

---------

Co-authored-by: Taylor Swanson <90622908+taylor-swanson@users.noreply.github.com>
Co-authored-by: Taylor Swanson <taylor.swanson@elastic.co>

CHANGELOG.next.asciidoc

@@ -102,6 +102,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 *Winlogbeat*
 
 
+- Add note in documentation about 21 event ID clause limit {issue}35048[35048] {pull}35049[35049]
 
 *Elastic Log Driver*
 

winlogbeat/docs/winlogbeat-options.asciidoc

@@ -251,7 +251,11 @@ logs.
 `WARN EventLog[Application] Open() error. No events will be read from this
 source. The specified query is invalid.`
 
-If you have more than 22 event IDs, you can workaround this Windows limitation
+In some cases, the limit may be lower than 22 conditions. For instance, using a
+mixture of ranges and single event IDs, along with an additional parameter such
+as `ignore older`, results in a limit of 21 conditions.
+
+If you have more than 22 conditions, you can workaround this Windows limitation
 by using a drop_event[drop-event] processor to do the filtering after
 {beatname_uc} has received the events from Windows. The filter shown below is
 equivalent to `event_id: 903, 1024, 4624` but can be expanded beyond 22