# Windows XML Event Log (EVTX) parser

Available in AxoSyslog version 4.5 and later.

The new `windows-eventlog-xml-parser()` can parse messages in the Windows XML Event Log (EVTX) format.

See also the equivalent FilterX function, [`parse_windows_eventlog_xml()`](../../docs/axosyslog-core/4.26/filterx/function-reference/index.md#parse-windows).

Example configuration:

Terminal window
```
    parser p_win {
        windows-eventlog-xml-parser(prefix(".winlog."));
    };
```

The `windows-eventlog-xml-parser()` parser has the same parameters are the same as the [`xml()` parser](../../docs/axosyslog-core/4.26/chapter-parsers/xml-parser/xml-parser-options/index.md).

Don’t forget to include the parsers in a log statement to actually use it:

Terminal window
```
    log {
        source(s_local);
        parser(windows-eventlog-xml-parser(prefix(".winlog.")));
        destination(d_local);
    };
```

Last modified July 29, 2026: [Link classic rewrite rules and parsers to their FilterX counterparts (e9be5c49)](<https://github.com/axoflow/axosyslog-core-docs/commit/e9be5c49098f40c3137bf588a8a7453ca2b061de>)