nx-log Event Logs to Logstash config

gistfile1.txt

######################
####  nxlog.conf  ####
######################

## This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally and is also available
## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log 

<Extension json>
    Module      xm_json
</Extension>

<Input internal>
  Module im_internal
</Input>

<Input eventlog>
    Module      im_msvistalog
</Input>

<Output out>
    Module      om_tcp
    Host        x.x.x.x
    Port        xxxx
    Exec        $EventReceivedTime = integer($EventReceivedTime) / 1000000; \
                to_json();
</Output>

<Route 1>
    Path        eventlog, internal => out
</Route>


###########################
####  logstash config  ####
###########################

input {
  tcp {
    type   => "eventlog"
    host   => "x.x.x.x"
    port   => xxxx
    format => 'json'
  }
}

filter {
  # Incoming Windows Event logs from nxlog
  # The EventReceivedTime field must contain only digits, or it is an invalid message
  grep {
    type              => "eventlog"
    EventReceivedTime => "\d+"
  }
  mutate {
    # Lowercase some values that are always in uppercase
    type      => "eventlog"
    lowercase => [ "EventType", "FileName", "Hostname", "Severity" ]
  }
  mutate {
    # Set source to what the message says
    type   => "eventlog"
    rename => [ "Hostname", "@source_host" ]
  }
  date {
    # Convert timestamp from integer in UTC
    type              => "eventlog"
    match             => [ "EventReceivedTime", "UNIX" ]
    #EventReceivedTime => "UNIX"
  }
  mutate {
    # Rename some fields into something more useful
    type   => "eventlog"
    rename => [ "Message", "@message" ]
    rename => [ "Severity", "eventlog_severity" ]
    rename => [ "SeverityValue", "eventlog_severity_code" ]
    rename => [ "Channel", "eventlog_channel" ]
    rename => [ "SourceName", "eventlog_program" ]
    rename => [ "SourceModuleName", "nxlog_input" ]
    rename => [ "Category", "eventlog_category" ]
    rename => [ "EventID", "eventlog_id" ]
    rename => [ "RecordNumber", "eventlog_record_number" ]
    rename => [ "ProcessID", "eventlog_pid" ]
  }
  mutate {
    # Remove redundant fields
    type   => "eventlog"
    remove => [ "SourceModuleType", "EventTimeWritten", "EventTime", "EventReceivedTime", "EventType" ]
  }
}