The following config is working for me to send windows event logs only for a specific Event Log source application, but it is sending duplicate messages for every Event Viewer event/entry. Can anybody see what the problem is with my config (below)? Running nxlog-ce-2.8.1248

define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension syslog>
Module xm_syslog
</Extension>
<Input eventlog1>
Module      im_msvistalog
ReadFromLast TRUE
Exec if (($Channel =~ /Application/) AND ($SourceName =~ /My app name/));
</Input>
<Input otherapp_log1>
Module im_file
File 'D:\Path\to\my\log\output.log'
SavePos TRUE
ReadFromLast TRUE
PollInterval 1
Exec $Message = $raw_event; $SyslogFacilityValue = 22;
</Input>
<Output graylog2>
Module om_tcp
Host 10.x.x.x
Port 514
Exec to_syslog_bsd();
</Output>
<Route 1>
Path     eventlog1, otherapp_log1 => graylog2
</Route>