Run winlogbeat updates the winlogbeat data from the Windows event log.
Any new event log does not get captured onto the winlogbeat data.
Using the same wnlogbeat.yml config file (slightly reconfigured for syntax) works on v.1.3.1 - the winlogbeat updates every 30 secs with new event logs from Windows.
Is this bug on 5.0 ?
Note: I'm not publishing to logstash at all yet, just trying to run winlogbeat sending event logs to a local output file.