nxlog receive IIS logs and Winevent logs via nxlog binary transport on Centos6

nxlog.conf

##This is a sample configuration file. See the nxlog reference manual about the
## configuration options. It should be installed locally under
## /usr/share/doc/nxlog-ce/ and is also available online at
## http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html

########################################
# Global directives                    #
########################################
User nxlog
Group nxlog

LogFile /var/log/nxlog/nxlog.log
LogLevel INFO

########################################
# Modules                              #
########################################
<Extension json>
    Module      xm_json
</Extension>

<Extension w3c>
  #map iis log fields to Field Types
    Module      xm_csv
    Fields      $date, $time, $website, $hostname, $serverip, $verb, $request, $querystring, $dstport, $user, $clientip, $httpversion, $useragent, $cookie, $referrer, $fqdn, $status, $substatus, $sc_win32_status, $sc_bytes, $cs_bytes, $time_taken
    FieldTypes  string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, integer, integer, integer, integer, integer, integer
    Delimiter   ' '
</Extension>


########################################
# Inputs                               #
########################################

<Input in-winevent>
  #Accept winevent logs on tcp port 5140 and convert to json
    Module      im_tcp
    Host        0.0.0.0
    Port        5140
    InputType   Binary
    Exec        $raw_event = to_json();
</Input>

<Input in-iis>
  #Accept IIS logs via tcp port 5141, drop comment lines, join the date+time fields into an EventTime field, convert to json
    Module      im_tcp
    Host        0.0.0.0
    Port        5141
    InputType   Binary
    Exec        if $raw_event =~ /^#/ drop();                    \
                else                                             \
                {                                                \
                    w3c->parse_csv();                            \
                    $EventTime = parsedate($date + " " + $time); \
                    to_json ();                                  \
}
</Input>


########################################
# Outputs                              #
########################################

<Output wineventfileout>
  #output winevents in json to a temporary file
    Module      om_file
    File        "/tmp/winevent.json"
</Output>

<Output iisfileout>
  #output iis in json to a temporary file
    Module      om_file
    File        "/tmp/iis.json"
</Output>

<Output winevent>
    Module      om_tcp
    Host        localhost
    Port        5150
</Output>

<Output iis>
    Module      om_tcp
    Host        localhost
    Port        5151
</Output>

########################################
# Routes                               #
########################################

<Route 1>
  #temporary commented: send winevent logs in json format to logstash which listens on tcp port 5150 on localhost with a buffer
#    Path        in-winevent => winevent
  #temporary write winevent logs in json format to a temporary file
    Path         in-winevent => wineventfileout
</Route>

<Route 2>
  #temporary commented: send iis logs in json format to logstash which listens on tcp port 5151 on localhost with a buffer
#    Path        in-iis => iis
  #temporary write iis logs in json format to a temporary file
    Path         in-iis => iisfileout
</Route>

Output is sent to logstash listening on tcp ports 5150 and 5151