Quick question.
The ignore: 72h function in the Winlogbeat sends logs from 3 days ago.
If I were to start winlogbeat and send a days worth of logs + the 3 days before and then restart winlogbeat. Would it send the 3 previous days worth of logs from that point again? (this would cause duplications).