The filter you should use is this. BE CAREFUL with copy and paste. Sometimes Unicode and code pages and all that cause invisible invalid characters to get into the filter when you copy from html to EventViewer or Supercharger. It's really safest to create the filter in EventViewer on a computer that has sysmon installed and copy and paste from here. But here goes:
<Query Id="0" Path="Microsoft-Windows-Sysmon/Operational">
Here's proof that Sysmon events CAN be forwarded. I created a custom event log on the collector via Supercharger and you see the sysmon events showing up in it having forwarded from my workstation where I have sysmon installed.