EVTX to JSON converter
To convert EVTX to JSON, drop your EVTX file in the box below. It converts straight away; press Download to save the JSON. It all happens in your browser, so your file stays on your device.
Convert to
What changes
| EVTX to JSON | What happens |
|---|---|
| Shape | A list of events: recordId, time, level, eventId, provider, computer, channel, user, and data with a field per value |
| Read by | Our own EVTX reader: the binary XML, its templates and every value type, in your browser |
| Each event | Time, level, event ID, provider, computer, channel, record ID and its data |
| Damaged logs | Chunks that are not readable are skipped and counted; checksums are checked and reported, never required |
| Size | Up to 1,000,000 events |
How to convert EVTX to JSON
- Add your EVTX. Drop the file in the box, or click to choose it. It becomes JSON straight away.
- Check the result. Look at the preview. The delimiter and value types are set for you; change them if needed.
- Download. Press Download to save the JSON.
Get a Windows event log as JSON, each event’s data as named fields, ready for a script or a log tool.
Questions
In C:\Windows\System32\winevt\Logs. Event Viewer also saves them with Save All Events As.
No. It is read in your browser. Security logs hold user names and addresses, so nothing leaves the computer.
The data each event carries is. Event Viewer adds the message text from DLLs on the computer that wrote the log, which a file alone does not have.
No. The conversion happens right in your browser, so your file stays on your device. There is no account to make, either.