I haven't seen this myself yet. Are you able to reliably reproduce the behavior?
Having debug logs from the process would be helpful so we could see what it was doing when the system stopped/crashed. And also having the corrupt file would be useful too. Maybe we can get some clues from it.
While the process is running it periodically flushes its state to disk if there were changes to the internal state. It does this after 10 updates or after 5 seconds, whichever comes first. It writes the state information to .winlogbeat.yml.new, closes the file, then moves it to .winlogbeat.yml. In this way, if the process dies while writing to the file it shouldn't corrupt the .winlogbeat.yml file. It would have to die while in the MoveFileEx system call to cause problems (but hopefully the move operation is atomic in the filesystem).
On shutdown it performs one final flush to disk if there are any changes that had not been written.