# After filebeat upgrades & preserving registry it sending duplicate events

**URL:** https://discuss.elastic.co/t/after-filebeat-upgrades-preserving-registry-it-sending-duplicate-events/313701
**Category:** Beats
**Tags:** filebeat
**Created:** [September 5, 2022, 3:56pm UTC](https://discuss.elastic.co/t/after-filebeat-upgrades-preserving-registry-it-sending-duplicate-events/313701 "2022-09-05T15:56:13Z")
**Posts on this page:** 1
**Showing post:** 14

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 14, 2022, 4:19pm UTC](https://discuss.elastic.co/t/after-filebeat-upgrades-preserving-registry-it-sending-duplicate-events/313701/14 "2022-09-14T16:19:00Z")

</div>

Apologies, I am not sure what to tell you at this point... if you are getting duplicated events in the last 24 hours.

It could be a bug in the conversion from 5.6 to 7.17 on windows... 5.6 is several years old / very very old.

You could try running a 6.x filebeat then a 7.x filebeat and see if the registry conversion works.

I do not think there is a simple answer at this point, you may just need to de-dup your data another way.

Perhaps looking at one of the older threads will help

> [@Duplicate events with Filebeat on windows on service restart](https://discuss.elastic.co/t/duplicate-events-with-filebeat-on-windows-on-service-restart/78743/12):
>
> Ok, so in 5.2 we can "solve" the problem by telling the user to use option 2 or 3 for the path config and in 5.3 it should be solved already.

---

_[View the full topic](https://discuss.elastic.co/t/after-filebeat-upgrades-preserving-registry-it-sending-duplicate-events/313701)._