I also have this issue (It's why I tried to filter by eventID).
Here are the last couple DBG lines of -e -d "*" and the panic lines. I hope it helps.
DBG messageFilesCache[ForwardedEvents] size=8
DBG WinEventLog[ForwardedEvents] Closing handle
panic: runtime error: slice bounds out of range
goroutine 41 [running]:
panic(0x9cca80, 0xc082002030)
/usr/local/go/src/runtime/panic.go:464 +0x3f4
github.com/elastic/beats/winlogbeat/sys/wineventlog.RenderEventNoMessage(0x1000053, 0xc08228c000, 0x4000, 0x4000, 0x0, 0x0, 0x0, 0x0)
/go/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/wineventlog_windows.go:203 +0x269
github.com/elastic/beats/winlogbeat/sys/wineventlog.RenderEvent(0x1000053, 0xc000000000, 0xc08228c000, 0x4000, 0x4000, 0xc0822b73c8, 0x0, 0x0, 0x0, 0x0)
/go/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/wineventlog_windows.go:184 +0x2ee
github.com/elastic/beats/winlogbeat/eventlog.(*winEventLog).Read(0xc08225dc20, 0x0, 0x0, 0x0, 0x0, 0x0)
/go/src/github.com/elastic/beats/winlogbeat/eventlog/wineventlog.go:134 +0x731
github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).processEventLog(0xc08200ce60, 0xc08228a200, 0x28abe8, 0xc08225dc20, 0xc082208620, 0xf, 0x3e94aa, 0xeceb046b9, 0xe3124a0a0, 0xda11c0)
/go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:214 +0x407
created by github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).Run
/go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:151 +0x383