I'm still having this issue but wanted to update with what I've found. The winlogbeat service only starts on a reboot and is stable until the service is restarted. After a restart attempt, we get an Error 1067: The process terminated unexpectedly. I thought this might be a Windows issues so I posted this over in the Microsoft forums but they ultimately said to check with the developer.
So I'm not sure why it starts on a reboot but not just a regular restart.