Hello,
Ok so AWS instance port is opened to 12201, how about you graylog Server, is that port opened also?
By chance did you check if nxlog service is running on MS 2019 (AWS Instance)?
AWS instance and Graylog server on the same subnet? If not can you PING your graylog server from your MS 2019 server?
Ping -t graylog-IP
If you execute the following command on Graylog server, do you see your port 12201?
sudo lsof -i -P -n | grep 12201
As for your configurations they seem to be alright.
I take it you blotted out your Graylog server IP address with “GraylogIP”?
<Output udp>
Module om_udp
Host GraylogIP :12201
OutputType GELF_UDP
</Output>
If you not getting messages with those configurations, I’m assuming something is blocking messages getting to your Graylog server like securty device, firewall, etc…
Hope this helps