The included index templates for logs-windows.powershell + logs-windows.powershell_operational data streams don't explicitly map message as a text field, so it gets mapped as a keyword due to dynamic_templates:

"dynamic_templates": [
    {
      "strings_as_keyword": {
        "mapping": {
          "ignore_above": 1024,
          "type": "keyword"
        },
        "match_mapping_type": "string"
      }
    }
  ]

The logs-windows.forwarded + logs-windows.sysmon_operational templates map message as a text field, which ultimately results in a mapping conflict for the logs-* Kibana index pattern.