@logstash_oz Sorry for the late reply. For the timestamp: With this PR (https://github.com/elastic/beats/pull/1703) I introduced a field last_read which stores the timestamp when the file was last read (not last modified). Currently this is not taken into account when starting a harvester, but it definitively gives the opportunity to do so. I'm thinking of doing some comparison of last_read and modTime in the future.
About your LS questions: If you have 3 workers the events should still be sent only once. Filebeat has the at least once principle so it can happen in some cases, that a line is sent more then once. Is it just an edge case that you see events multiple times (for example when a node goes down) or happens that very often?