Duplicate entries result from multiple Winlogbeats

Can you please share the JSON content of the two "duplicate" events. You can copy the JSON out of Kibana's Discover page. It will be easier to offer advice if we can see the data in question. Feel free to anonymize the data as necessary.