Is there a reason you are using snare over syslog?gelf is the recomended encoding for sending from nxlog to Graylog. gelf will preserve all the individual fields so you dont need to parse them once recieved.
You can see an example config here Sample NXLog Windows Collection configuration
You will of course also need to create a gelf input to receive it.