In the Windows event stanza make sure it's [WinEventLog:Application] NOT [WinEventLog://Application] this fixed it for me