How to include a server identifier in nxlog output and reference it in logstash

You probably have an integer in the FieldTypes of your w3c xm_csv module instance. Unfortunately it cannot handle the dash '-' and fails parsing it as an integer.

You should add the UndefValue to your CSV options so that it knows a dash means no data:

<Extension w3c>
    Module      xm_csv
    Fields  $date $time $s-sitename $s-computername $s-ip $cs-method $cs-uri-stem $cs-uri-query $s-port $cs-username $c-ip $cs-version $cs-user-agent $cs-cookie $cs-referer $cs-host $sc-status $sc-substatus $sc-win32-status $sc-bytes $cs-bytes $time-taken
    Delimiter   ' '
    QuoteChar   '"'
    EscapeControl FALSE
    UndefValue  -
</Extension>

I would suggest trying the tcp input, forget about defining the codec in your input, it's generally a bad idea I have found:

input {
  tcp {
    type   => "eventlog"
    port   => 3515
  }
}
filter {
  multiline {
    pattern => "^\s"
    what => "previous"
  }
  json {
    "source" => "message"
  }
}

output {
  elasticsearch {
    cluster => "MyElkCluster"
    host => "127.0.0.1"
  }
}

So in this config, it will accept the traffic on the tcp port defined, not setting a codec, then pass the input to a multiline filter, which will look for lines which start with whitespace, and if it finds any it will join them to the previous line. That new line created by muliline will then be passed to the json filter, which should be able to parse the entry.