>

Filter Windows Event Logs with Get-WinEvent -FilterHashtable

Query System, Application, or Security logs for recent errors using FilterHashtable — far faster than piping Get-EventLog through Where-Object.

Windowstroubleshootingpowershellevent-logLow risk
Run Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddDays(-7)} to get the last week's error events.

01Command

Command
$ Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 20 | Format-Table TimeCreated, Id, ProviderName, Message -AutoSize

02What it does

-FilterHashtable pushes the filter into the Windows Eventing engine, so it reads only matching records, while `Get-EventLog | Where-Object` deserializes every event first and crawls on large logs. Level 2 = Error, 3 = Warning, 1 = Critical; StartTime/EndTime accept DateTime objects. It can also read.evtx files with -Path and collapsed providers with -ProviderName, covering most of what wevtutil does with friendlier output.

03Risk

RiskLow risk

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Get-WinEvent
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents FilterHashtable parameters including LogName, Level, and StartTime for server-side filtering.
  • Get-WinEvent - SS64
    SS64 · technical · 2026-09-17
    Evidence: Shows FilterHashtable usage examples for querying System and Application logs by level and date range.

Last verified: 2026-09-17 · Category: System & Settings

06Related solutions

Test a TCP port connection on Windows with Test-NetConnection
Windowsnetworktroubleshootingpowershell

A built-in PowerShell one-liner that answers 'is port 5432/3389/443 actually open through this network?' — no telnet client needed.

Low risk ✓ 2026-09-17
Flush the DNS resolver cache on Windows
WindowsnetworkDNStroubleshooting

Purge cached DNS lookups so Windows re-resolves hostnames from scratch — the fix for 'the new server is live but my browser still hits the old one'.

Medium risk ✓ 2026-09-17
Grep on Windows: Select-String
Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17