Windows Event ID not forwarding when using GELF output

When using the GELF TCP output to send Windows Event logs to NXLog (yes, the other direction of what is commonly done) I noticed the $EventId field is not being populated. As far as I can tell it is the only field missing with the GELF output.

## Expected Behavior
NXLog log should receive and parse the $EventId field from the GELF TCP input

## Current Behavior
The $EventId field is NULL from the GELF output

## Steps to Reproduce (for bugs)
1. Configure NXLog to receive GELF TCP input on TCP/12201
2. Configure Graylog GELF TCP output to forward to NXLog server on TCP/12201
3. Attach GELF TCP output to Stream with Windows Events (verify EventID has a value)

## Context
The goal is to forward Windows Events from Graylog to an external logging source such as another SIEM like Splunk, LogRhythm, etc. Using NXLog allows debugging of the log messages to file outputs making it easier to detect issues with the GELF stream.

Here is the configuration of `nxlog.conf` for reference
```

Module xm_gelf

Module xm_json

Module im_tcp
Host 0.0.0.0
Port 12201
InputType GELF_TCP

Module om_file
File "/tmp/output"
Exec to_json();

Path gelf => file

```

## Your Environment
Graylog Server running on RHEL7. NXLog Enterprise running on RHEL7.

* Graylog Version: 3.2.3
* Elasticsearch Version: 6.8.6
* MongoDB Version: 4.0.16
* Operating System: RHEL7
* Browser version: n/a