xpath - Filtering events in Event Viewer using a regex -

i have event log thousands of events. want make custom filter or view shows of them. want filter them using regex (or simple text match) on either entire text of xml (as text), or on particular field. event viewer support ctl+f finding, apparently can't put same find action custom view used every time.

• environment: microsoft windows server 2012 standard
• program: event viewer

i've looked @ creating custom view, , editing xml source of custom view properties try filter them.

the events this:

<event xmlns="http://blahblah.com">   <eventdata>     <data>blah smith blah     </data>   </eventdata> </event> 

and want text match / regex on data field.

i've tried lot of things this:

<querylist>   <query id="0" path="">     <select path="">        *[eventdata[data=regex("*smith*")]]     </select>   </query> </querylist> 

as other lines like

*[eventdata[data="%smith%")]] *[eventdata[data="%%smith%%")]] 

but no result or invalid xpath error.

how can this? i'd interested in knowing name am. full xpath, or have specific microsoft version name? how can list of namespace exists within *event line? how can access compile/runtime errors whatever interpreting attempts @ writing xpath?

i'd accept solutions in form of programs connect event viewer api. it'd better if easy use & integrated program itself, powershell version of event log filtering useful.

overall want filter events out of event log based on regex (or simple text matching) of contents. theoretically should easy - ctl+f find can it, events stored on local computer somewhere, , have apparently sophisticated custom view filter setup.

using powershell, there easy workaround:

get-eventlog -logname security | where-object { $_.message -like 'testsite' } | format-table message -wrap -autosize | out-file c:\users**username**\desktop\out.txt

you need specify own logname, text searched , outfile path.

the "format-table message -wrap -autosize" makes sure messages/exceptions won't truncated. if want field other message, replace "$_.message" appropriate field name.

cheers