You could either collect logs via WMI, or make use of Windows's own mechanisms for forwarding event logs to the "Forwarded events" log on the host, and have the forwarder pick up things there. The best idea in most cases though is to install a Universal Forwarder on each of the hosts that you want to collect events from, as it gives you better control, performance and fault tolerance compared to the alternatives.
