c# - EventLogSession.ExportLogAndMessages query

Question

I need to save windows event logs in some file, now i am using:

var els = new EventLogSession();
els.ExportLogAndMessages("Application", PathType.LogName, "*", Path.Combine("c:\\Application.evtx"), false, CultureInfo.CurrentCulture);

this works fine but i want to get logs between DateTime range, i suspect that 3rd parameter in ExportLogAndMessages "query" may help me.

now how to write this "query", and if "query" doesn't help is there anyway to do that.

Answer 1

Both pages aren't very helpful as the query syntax isn't clear.

You can right-click any log in the Event Viewer and choose "Filter Current Log...", when you create a filter you'll see the underlying xml in the next tab. You can use it as your query.

Answer 2

These links can help you to form your query:

How to: Query for Events

Event Queries and Event XML

You should compose a query to get events in some date range only.

I think you can use: TimeCreated parameter in your query.