Struct EventLog 

pub struct EventLog { /* private fields */ }

Handle to an opened event log or log file.

Implementations

impl EventLog

pub fn open(channel_name: &str) -> Result<Self>

Open an event log channel by name.

Examples: “Security”, “System”, “Application”, “Windows PowerShell”, etc.

pub fn open_file(path: &Path) -> Result<Self>

Open an event log file (.evtx, .evt, or .etl format).

pub fn list_channels() -> Result<Vec<String>>

List available event log channels.

pub fn list_channels_filtered(filter: ChannelFilter) -> Result<Vec<String>>

List event log channels with a specific filter.

pub fn query(&self, builder: &QueryBuilder) -> Result<EventQueryResult>

Query events using a query builder.

This returns all matching events at once. For large result sets, prefer query_stream() with batch processing.

pub fn query_stream(&self, xpath: &str) -> Result<EventQuery>

Query events in a streaming fashion with batch processing.

Returns an EventQuery handle for batch iteration with buffer reuse. Use query_stream() for processing large logs efficiently.

Trait Implementations

impl Drop for EventLog

fn drop(&mut self)

Executes the destructor for this type.