There are WMI plugin and Eventlog plugin. Both do not support remote eventlog.
There is also WinLogBeat that dont support remote as well.
There is also a documented feature for WMI here: https://logstash.jira.com/browse/LOGSTASH-1747, but first need to enhance it to support 'tail like' functionality and secondly the WMI solution is not recommnded by Microsoft for pulling eventlog data.
And last, there are discussions about nxlog with LogStash.
So what is the preffered way currently to collect windows eventlog data remotly?
I'll appreciate your thoughts.