Today I started to run winlogbeat on a number of Windows 2008 R2 servers and was succesfully transferring windows eventlogs to my elk stack without any problems.
We ran into a problem later on in the day with time across our domain and I'd found that one of our DCs was 5 minutes out. Monitoring the time of this server compared to the NTP servers I noticed that it was it was getting a second faster every minute. The only thing I'd changed today was to install the winlogbeat as a service. Once I stopped the service the time stopping getting increasingly ahead of the real time. I reset the clocks and monitored without winlogbeat running and the time stayed within a 2 second discepency. As soon as I started winlogbeat the time again became an extra second out after every minute. The reason my server was 5 minutes (300 seconds) out was because I'd started winbeatlog about approximately 5 hours previously (300 minutes at 1 second per minute = 300 seconds.).
Anyone else experienced a similar issue?