# Get-WinEvent and filtering for the message

**URL:** <https://forums.powershell.org/t/get-winevent-and-filtering-for-the-message/945>\
**Category:** PowerShell Help\
**Created:** [December 31, 2011, 6:30pm UTC](https://forums.powershell.org/t/get-winevent-and-filtering-for-the-message/945 "2011-12-31T18:30:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![archives](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@archives](https://forums.powershell.org/u/archives)\
**Post date:** [December 31, 2011, 6:30pm UTC](https://forums.powershell.org/t/get-winevent-and-filtering-for-the-message/945/1 "2011-12-31T18:30:00Z")

</div>

by surveyor at 2013-05-10 10:03:06

> Hi,  
> with this little script (it works) I try to filter scheduled tasks (beginning and end) from the eventlog. Is it possible to filter for messages in the XML-Filter instead of using Where-Object? I have searched a lot, but there are only a few examples and the official documentation is too confusing for me.  
>   
> `Clear-Host$XMLQuery = @"<QueryList>	<Query Id="0" Path="Microsoft-Windows-TaskScheduler/Operational"> <Select Path="Microsoft-Windows-TaskScheduler/Operational">*[System[(Level=4 or Level=0) and (EventID=100 or EventID=102)]]</Select>	</Query></QueryList>"@$Abruf = {	# Wegen .NET-Bug auf englische Umgebung umschalten. Ansonsten werden keine Meldungstexte ausgegeben. $orgCulture = Get-Culture [System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"	Get-WinEvent -FilterXml $XMLQuery | Where-Object { $_.Message -notmatch "\Microsoft\" } # |# Select-Object -First 5	# Wegen .NET-Bug. Siehe oben. [System.Threading.Thread]::CurrentThread.CurrentCulture = $orgCulture}$a = Get-Date$Test = . $Abruf$b = Get-Date$Test.Count$a$b`  
>   
> PS: I’m not very happy with the new forum…

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 9:03pm UTC](https://forums.powershell.org/t/get-winevent-and-filtering-for-the-message/945/2 "2024-05-16T21:03:32Z")

</div>