Could you clarify what you mean by "keep track of"?
Logstash doesn't keep track of anything related to Winlogbeat when restarted. Winlogbeat sends events to Logstash and when Logstash has written the event to its in-memory queue it sends and ACK to Winlogbeat. After Winlogbeat receives the ACK it considers the event to have been successfully delivered and it will persist information about the last successful event to disk. This allows Winlogbeat to restart and resume from the last known read position.
If Logstash is restarted while there are events stored in the in-memory queue those events are lost. That's why Logstash has [persistent queues](https://www.elastic.co/guide/en/logstash/current/persistent-queues.html) that persist the events to disk before sending the ACK back to Winlogbeat. If you enable the persistent queue feature then on restart you can be sure that no events will be lost.
Apache Lucene, Apache Solr and all other Apache Software Foundation project and their respective logos are trademarks of the Apache Software Foundation.
Elasticsearch, Kibana, Logstash, and Beats are trademarks of Elasticsearch BV, registered in the U.S. and in other countries. This site and Sematext Group is in no way affiliated with Elasticsearch BV.
Service operated by Sematext