nxlog query block

query.txt

<Input in>
    Module      im_msvistalog
    ReadFromLast    True

Query   <QueryList>\
        <Query Id="0">\
            <Select Path="Security">*</Select>\
            <Select Path="System">*[System/Level=4]</Select>\
            <Select Path="Application">*[Application/Level=2]</Select>\
            <Select Path="Setup">*[System/Level=3]</Select>\
            <Select Path="Windows PowerShell">*</Select>\
		 <Select Path="Microsoft-Windows-Sysmon/Operational">*</Select>\
 </Query>\
    </QueryList>

# For windows 2003 and earlier use the following:
#   Module      im_mseventlog
</Input>