I think I discovered a bug and wanted the community's opinion before I submit an issue on GitHub.
First, this only happens with forwarded events. I haven't been able to reproduce with locally generated events.
- When starting winlogbeat, if the registry file does not exist, then it starts processing all events in the monitored event log from the beginning as would be expected.
- If the registry file does exist, even if the timestamp/record_number saved is in the past by, say, several minutes, winlogbeat will not resume at that point. Rather, it starts processing events that are just coming in. Events that are between the timestamp saved in the registry file, and the moment that winlogbeat is started, are lost.
Can anybody else reproduce this? Or maybe I'm doing something wrong? I'm running Winlogbeat 5.0.2 on Windows 2012 R2.