How to filter xml logs from wineventlog?

[mjemi]

I want to filter eventcode 4624 and user_type=computer using transforms and props.conf

Transforms.conf

[setnule]
REGEX = \<EventID\>4624\<\/EventID\>.+\<Data\s+Name='WorkStationName'>
DEST_KEY = queue
FORMAT = nullQueue

props.conf

[XmlWinEventLog]
TRANSFORMS-set=setnule