Retry on publisher disabled error

winlogbeat/eventlog/errors_windows.go

@@ -31,7 +31,7 @@ import (
 func IsRecoverable(err error) bool {
 	return err == win.ERROR_INVALID_HANDLE || err == win.RPC_S_SERVER_UNAVAILABLE ||
 		err == win.RPC_S_CALL_CANCELLED || err == win.ERROR_EVT_QUERY_RESULT_STALE ||
-		err == win.ERROR_INVALID_PARAMETER
+		err == win.ERROR_INVALID_PARAMETER || err == win.ERROR_EVT_PUBLISHER_DISABLED
 }
 
 // IsChannelNotFound returns true if the error indicates the channel was not found.

winlogbeat/sys/wineventlog/syscall_windows.go

@@ -40,15 +40,16 @@ const NilHandle EvtHandle = 0
 // Event log error codes.
 // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681382(v=vs.85).aspx
 const (
-	ERROR_INVALID_HANDLE        syscall.Errno = 6
-	ERROR_INVALID_PARAMETER     syscall.Errno = 87
-	ERROR_INSUFFICIENT_BUFFER   syscall.Errno = 122
-	ERROR_NO_MORE_ITEMS         syscall.Errno = 259
-	RPC_S_SERVER_UNAVAILABLE    syscall.Errno = 1722
-	RPC_S_INVALID_BOUND         syscall.Errno = 1734
-	RPC_S_CALL_CANCELLED        syscall.Errno = 1818
-	ERROR_INVALID_OPERATION     syscall.Errno = 4317
-	ERROR_EVT_CHANNEL_NOT_FOUND syscall.Errno = 15007
+	ERROR_INVALID_HANDLE         syscall.Errno = 6
+	ERROR_INVALID_PARAMETER      syscall.Errno = 87
+	ERROR_INSUFFICIENT_BUFFER    syscall.Errno = 122
+	ERROR_NO_MORE_ITEMS          syscall.Errno = 259
+	RPC_S_SERVER_UNAVAILABLE     syscall.Errno = 1722
+	RPC_S_INVALID_BOUND          syscall.Errno = 1734
+	RPC_S_CALL_CANCELLED         syscall.Errno = 1818
+	ERROR_INVALID_OPERATION      syscall.Errno = 4317
+	ERROR_EVT_CHANNEL_NOT_FOUND  syscall.Errno = 15007
+	ERROR_EVT_PUBLISHER_DISABLED syscall.Errno = 15037
 )
 
 // EvtSubscribeFlag defines the possible values that specify when to start subscribing to events.