Changing the config from:
default['winlogbeat']['version'] = '1.2.2'
default['winlogbeat']['package_url'] = 'auto'

to:
default['winlogbeat']['version'] = '5.4.2'
default['winlogbeat']['package_url'] = 'https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-5.4.2-windows-x86_64.zip'

fails when the service tries to start.

Ive changed a couple sections of code to enable logging to logstash, it works with older version:
default['winlogbeat']['config']['winlogbeat']['registry_file'] = 'C:/ProgramData/winlogbeat/.winlogbeat.yml'
default['winlogbeat']['config']['winlogbeat']['event_logs'] = [
{ 'name' => 'Security', 'ignore_older' => '24h' },
{ 'name' => 'System', 'ignore_older' => '24h' }
]

Logstash Output config info

default['winlogbeat']['config']['output']['logstash']['enabled'] = true
default['winlogbeat']['config']['output']['logstash']['hosts'] = ['cbs-elk.hl.aws:5044']
default['winlogbeat']['config']['output']['logstash']['loadbalance'] = true
default['winlogbeat']['config']['output']['logstash']['save_topology'] = false
default['winlogbeat']['config']['output']['logstash']['index'] = 'winlogbeat'

The error is:
Error executing action start on resource 'windows_service[winlogbeat]'
SystemCallError

The parameter is incorrect. - StartService: The parameter is incorrect.

Im wondering if maybe the the new version doesnt like the config. I will continue to update this if I find out more info.