nxlog event sorting

gistfile1.txt

define MonitoredEventIds    4774, 4775, 4776, 4777, 4741, 4742, 4743, 4744, 4745, 4746, \
                            4747, 4748, 4749, 4750, 4751, 4752, 4753, 4759, 4760, 4761, \
                            4762, 4763, 4782, 4793, 4727, 4728, 4729, 4730, 4731, 4732, \
                            4733, 4734, 4735, 4737, 4754, 4755, 4756, 4757, 4758, 4764, \
                            4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, \
                            4767, 4780, 4781, 4794, 5376, 5377, 4688, 4696, 4662, 5136, \
                            5137, 5138, 5139, 4625, 4634, 4647, 4624, 4625, 4648, 4675, \
                            4649, 4778, 4779, 4800, 4801, 4802, 4803, 5378, 5632, 5633, \
                            4964, 4698, 4699, 4700, 4701, 4702, 5890, 5888, 5889, 4656, \
                            4715, 4719, 4902, 4904, 4905, 4906, 4907, 4908, 4912, 4706, \
                            4707, 4713, 4716, 4717, 4718, 4739, 4864, 4865, 4866, 4867, \
                            4704, 4705, 4706, 4707, 4714, 4672, 4673, 4674, 4960, 4961, \
                            4962, 4963, 4965, 5478, 5479, 5480, 5483, 5484, 5485, 5024, \
                            5025, 5027, 5028, 5029, 5030, 5032, 5033, 5034, 5035, 5037, \
                            5058, 5059, 4608, 4609, 4616, 4621, 4610, 4611, 4614, 4622, \
                            4697, 4612, 4615, 4618, 4816, 5038, 5056, 5057, 5060, 5061, \
                            5062

<Input eventlog>
    Module  im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id='0'>
                <Select Path='Security'>*</Select>
            </Query>
        </QueryList>
    </QueryXML>
    <Exec>
        if $EventID NOT IN (%MonitoredEventIds%) drop();
    </Exec>
</Input>