nxlog config file

nxlog.conf

# define ROOT dir
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

#<Extension _syslog>
#    Module      xm_syslog
#</Extension>

<Extension _json>
    Module		xm_json
</Extension>

<Input eventlog>
    Module      im_msvistalog
    Query <QueryList> \
      <Query Id="0"> \
	<Select Path="Application">*[System[(EventID=1102)]]</Select> \
	<Select Path="Microsoft-Windows-Powershell/Operational"> \
		*[System[(EventID=1102 or EventID=4103 or EventID=4104)]] \
	</Select> \
	<Select Path="Microsoft-Windows-Sysmon/Operational">*</Select> \
	<Select Path="Security"> \
		*[System[ (EventID=1102 or EventID=4624 or EventID=4625 or \
                 EventID=4720 or EventID=4722 or EventID=4732)]] \
	</Select> \
	<Select Path="System">*[System[(EventID=1102 or EventID=7009 or EventID=7045)]]</Select> \
      </Query> \
    </QueryList>
</Input>

<Output logstash>
    Module      om_tcp
    Host        10.10.1.4
    Port        3515
    Exec        to_json();
</Output>

<Route json_logger>
    Path eventlog => logstash
</Route>


#<Output syslog>
#    Module      om_tcp
#    Host        10.10.1.4
#    Port        514
#    Exec        to_syslog_snare();
#</Output>
#<Route 2>
#    Path		eventlog => syslog
#</Route>