We have just migrated to Elastic Stack 5.2.
Filebeat version 5.2.1
We have filebeats running on Windows Server 2012 R2 and every time the filebeat service is restart all lines from all harvested logs gets send again.
The registry file is updated (Can be seen from the modification time of the file).
We have furthermore tried to close filebeat, delete the registry file, start filebeat which results in a new registry file being created which seems to be valid.
However, when the service is restarted after the new registry file is created all log lines gets send once more.
Filebeat configuration: https://gist.github.com/Steiniche/d2c62c6aaac71d989039346340412203
Registry file from a server: https://gist.github.com/Steiniche/5893b3b5ad8d6e5fb63f2004a3679129