Centralized logging on Windows with nxlog, logstash, elasticsearch and kibana

logstash-indexer.conf

input {
  udp {
    port => 5959
    type => "Win32-EventLog"
    format => "json"
  }
}

output {
  stdout {
    codec => rubydebug
  }
  elasticsearch {
    embedded => true
  }
}

nxlog.conf

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.

<Extension json>
    Module      xm_json
</Extension>

<Input eventlog>
    Module      im_msvistalog
	Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
</Input>

<Processor buffer_udp>
    Module      pm_buffer
    # 1Mb buffer
    MaxSize 1024
    Type Mem
    # warn at 512k
    WarnLimit 512
</Processor>

<Output out_udp>
    Module      om_udp
    Host        10.0.1.8
    Port        5959
</Output>

<Route 1>
    Path        eventlog => buffer_udp => out_udp
</Route>