Apologies, I am not sure what to tell you at this point... if you are getting duplicated events in the last 24 hours.
It could be a bug in the conversion from 5.6 to 7.17 on windows... 5.6 is several years old / very very old.
You could try running a 6.x filebeat then a 7.x filebeat and see if the registry conversion works.
I do not think there is a simple answer at this point, you may just need to de-dup your data another way.
Perhaps looking at one of the older threads will help