After filebeat upgrades & preserving registry it sending duplicate events

Apologies, I am not sure what to tell you at this point... if you are getting duplicated events in the last 24 hours.

It could be a bug in the conversion from 5.6 to 7.17 on windows... 5.6 is several years old / very very old.

You could try running a 6.x filebeat then a 7.x filebeat and see if the registry conversion works.

I do not think there is a simple answer at this point, you may just need to de-dup your data another way.

Perhaps looking at one of the older threads will help