Search code examples
powershellget-winevent

get-winevent output to a file getting stored as binary

I am using get-winevent to convert an evtx log to .json file. Then I've send it to ELK.
Get-WinEvent -Path .\log.evtx | ConvertTo-Json|Format-List | Out-File log.json
The file looks like a normal string containing file on windows. But when I take it to linux, it contains binary data and cannot be parsed to ELK. enter image description here


Even if I use out-string, nothing changes.
$result = Get-WinEvent -Path .\user-creation-1log.evtx | ConvertTo-Json| Format-List
$result | Out-String | out-file log.json

This also appears like a binary file in linux. (Although I remember export-csv with get-winevent created complete text file, but this makes a really ugly formatted csv file). I really liked the way convertTo-json formatted and valued the json data and would prefer it. (if someone can provide a different way to convert the evtx data in its fullest form to json, happy to take).
I've tried evtx2csv python module, but that doesn't write output to a file.

Solution

  • First, don't use Format-List if you intend to export JSON. This is only for formatting objects as a nice visual representation in the console.

    Also, I don't use Linux, but I guess it's safest to specify utf8 as encoding explicitly to make sure it's compatible:

    Get-WinEvent -Path .\log.evtx | ConvertTo-Json | Out-File log.json -Encoding utf8