[Filebeat] winlog input metrics are unregistered after recovery

[andrewkroh]

When the winlog input encounters an error, such as the Microsoft-Windows-Windows Defender provider being removed during updates, it attempts to recover. The recovery is done by calling Close() and the Open(). But the lifetime of the input metrics is tied into the construction of the reader and Close(). So when open is called for a second time the input will not have any metrics registered.

After the failure occurred there were not more metrics:

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)