The "Preview" button is simply to verify that your criteria is finding what you are looking for and it will provide you with ALL matches found within the Event Log. When monitoring, the Event Log Monitor will not notify you of matches for events that were written previous to when the Monitor is created and it will only notify you when it has found a match between the current time and the last time it has verified the log.
The %capture[timewritten]% token is used to pass the timestamp of the event to the Content Generator. More on this found here:
Hope this helps clarify things.