test

define ROOT C:\Program Files\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _syslog>
    Module      xm_syslog
</Extension>

<Input eventlog>
    Module      im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id="0">
                <Select Path="Security">*</Select>
                <Select Path="System">*</Select>
                <Select Path="Application">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
            </Query>
        </QueryList>
    </QueryXML>
</Input>

<Output fsiem>
    Module      om_udp
    Host        10.1.16.137
    Port        514
    Exec        to_syslog_snare();
</Output>

<Route eventlog_to_fsiem>
    Path        eventlog => fsiem
</Route>