Forked from sean-m/log-reader-config.ps1. I changed the script so that logstash-forwarder is started as a process and the json event messages are pushed to the stdin of logstash-forwarder. I don't know how this will be affected by network connectivity, but it means I don't need to worry about a log file on the C: drive growing ever larger.

log-reader.ps1

#Requires -Version 3
param (
	[string]$lognames
)

#reading security log requires elevated privileges so only read Application and System for now
[string[]]$logname = $("Application", "System" )

if ($lognames)
{
    [string[]]$logname = $lognames -split ", "
}

 
##################################
#            Functions           #
##################################
 
function EvenSpace{
    param ($word) 
 
    $tabWidth = 48
 
    $wordTabs = $tabWidth - $word.Length
    $tabNum = [Math]::Floor($($wordTabs/4)) / 2
 
    ("`t" * $tabNum)
}
 
 
## Read events, write to file
function ReadEvents {
    param ([hashtable]$filter, [string]$OutFile=[String]::Empty)
        
    ## Make it look pretty if writting to stdout    
    try {
        [object[]]$data = Get-WinEvent -FilterHashtable $filter -ErrorAction SilentlyContinue | sort RecordId
        
        [int]$count = 0
        if ((-not $data -eq $null) -or ($data.Count -gt 0)) {            
            $count = $data.Count
        }
        
        
        Write-Verbose ("Log: $($filter["LogName"])" + (EvenSpace -word $filter["LogName"]) + "Count: $count")
    }
    catch {
        $Error[0]
        Write-Verbose ""
        Write-Verbose "Filter:"
        $filter
        return
    }
 
 
    if ($data.Count -gt 0) {
 
        foreach ($event in $data) {
            $json = $event | ConvertTo-Json -Compress
			#$jsonbytes = @($json)
			#$process.StandardInput.BaseStream.Write($jsonbytes,0,$jsonbytes.Count)
			
            Write-Verbose $json

			$process.StandardInput.WriteLine($json)
        }
    }
}

## Use a try/catch/finally to allow for the inputs to be closed and the process stopped
[System.Diagnostics.Process]$process = $null
$endTime = Get-Date

try
{
    ## Prepare to invoke the process
    $processStartInfo = New-Object System.Diagnostics.ProcessStartInfo
    $processStartInfo.FileName = (Get-Command .\logstash-forwarder.exe).Definition
    $processStartInfo.WorkingDirectory = (Get-Location).Path
    $processStartInfo.Arguments = "-config logstash-forwarder.conf"
    $processStartInfo.UseShellExecute = $false

    ## Always redirect the input and output of the process.
    ## Sometimes we will capture it as binary, other times we will
    ## just treat it as strings.
    $processStartInfo.RedirectStandardOutput = $true
    $processStartInfo.RedirectStandardInput = $true

    $process = [System.Diagnostics.Process]::Start($processStartInfo)
  
    ##################################
    #           Main Logic           #
    ##################################
 
    ## Loop to capture events
    while ($true) {
        [String]::Empty | Write-Verbose
 
        Start-Sleep -Seconds 5
	
        $startTime = $endTime
 
        [TimeSpan]$diff = (Get-Date) - $startTime
        if ($diff.TotalHours -gt 1) {
            $endTime = $startTime + (New-TimeSpan -Minutes 30)
        }
        else {
            $endTime = Get-Date
        }
 
        Write-Verbose "Starting timespan $($startTime) -> $($endTime)"
 
        ## Supports reading multiple logs
        if ($logname.Count -gt 1) {
            foreach ($log in $logname) {
                ReadEvents -filter @{LogName=$log; StartTime=$startTime; EndTime=$endTime} -OutFile $output
            }
        }
        else {
            ReadEvents -filter @{LogName=$logname; StartTime=$startTime; EndTime=$endTime} -OutFile $output
        }
    }
}
catch
{
    Write-Error $error[0]|format-list -force
    throw $_.Exception
}
finally
{
    if($process)
    {
        $process.StandardInput.Close()
        $process.Close()
    }
}

To use, place the powershell script in the same folder as your logstash-forwarder.exe and use NSSM to run the script as a service.