https://nathanguagenti.blogspot.com/2018/01/canary-files-for-legit-access-abuse-with-wef-and-elk.html

nxlog-config-for-wef-server.conf

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _json>
    Module xm_json
</Extension>

<Input WinEvtsIn>
    Module  im_msvistalog
    Channel ForwardedEvents
</Input>

<Output LogstashOut>
    Module      om_tcp
    Host        #TODO:$LogstasthIPHere
    Port        #TODO:$LogstashPortHere
    Exec        to_json(); $message = $raw_event;
</Output>

<Route 1>
    Path        WinEvtsIn => LogstashOut
</Route>