Request EventLogSession.ExportLogAndMessages

Question

I need to save Windows event logs in some kind of file, now I use:

var els = new EventLogSession(); els.ExportLogAndMessages("Application", PathType.LogName, "*", Path.Combine("c:\\Application.evtx"), false, CultureInfo.CurrentCulture); 

this works fine, but I want to get logs between the DateTime range, I suspect that the third parameter in ExportLogAndMessages "query" might help me.

Now, how to write this “request”, and if the “request” does not help, it's all the same for that.

Answer 1

These links can help you formulate your request:

A practical guide. Request for events

Event Queries and Event XML

You must make a request to receive events only in the date range.

I think you can use the TimeCreated parameter in your request.

Answer 2

Both pages are not very useful because the syntax of the request is not clear.

You can right-click on any log in the event viewer and select "Filter current log ...", when creating a filter, you will see the basic xml in the next tab. You can use it as your request.