title: Issue selecting specific levels of windows application logs in NXLog
body: <p>I'm trying to pass only Warning / Error / Critical level Application Logs through NXLog to my ELK stack.  When I have this configuration </p>
  
  <p><code>&lt;Input EventLog_In&gt;
      Module      im_msvistalog
      # this kinda works for me, put * to get everything
      Query       &lt;QueryList&gt;\
                      &lt;Query Id="0"&gt;\
                          &lt;Select Path="Application"&gt;*&lt;/Select&gt;\
              &lt;/Query&gt;\
                  &lt;/QueryList&gt;
      Exec to_json();
  &lt;/Input&gt;</code> </p>
  
  <p>everything works fine, and I'm collecting all levels of Application logs.  I tried putting in a parameter on the <code>&lt;Select Path&gt;</code> line like this </p>
  
  <p><code>&lt;Select Path="Application"&gt;*[Application/Level=1]&lt;/Select&gt;\</code></p>
  
  <p>And it craps itself and I get nothing.  NXLog isn't reporting any issue, and I'm not seeing anything on the logstash side of things.  </p>
  
  <p>I got the information about Event Viewer querying from this thread and adapted it to my use case: 
  <a href="https://serverfault.com/questions/543494/query-specific-logs-from-event-log-using-nxlog">https://serverfault.com/questions/543494/query-specific-logs-from-event-log-using-nxlog</a></p>