I am not too familiar with Event Log Forwarder, but just to suggest a different approach - could you use Server & Application Monitor?
You can create a custom SAM application template with Windows Event Log component and simply monitor mentioned Event IDs.
With that approach, you will gain much more statistics and data. Events in SolarWinds will be organized in the same way as in Event Viewer.
IT-Indago Ltd. - Authorized Reseller & SolarWinds Certified SCP Professional
If the device is monitored within SolarWinds could you not set up an alert for "Last Boot has changed"