Hi, i'm interested in the same.
The solution i've thought by now is using NTSyslog and Kiwi Together. NTSyslog sends messages gotten from the EventViewer in UDP to localhost where are recived by Kiwi who has the ability to send over TCP in the SSH Tunnel (I use plink) .
By this moment i have a problem. Kiwi uses '\r' as separator for TCP messages and Syslog-ng uses '\n', so when syslog-ng recives 5 messages in one TCP message from a Kiwi, he only gets the syslog header from the 1st message, and sees all the rest as part of the first one.
Cya.
I accept critics(very welcolme).
PD: Sorry for my english.