How does Logstash keep track of Winlogbeat events?

Why would that be a problem?