How do I convert EVTX to JSON from the command line?

Use evtx_dump from the omerbenamram/evtx project: evtx_dump -o json Security.evtx > events.json, or -o jsonl for one event per line. This site runs the same parser in the browser when you don't want to install anything.

How do I convert EVTX to JSON with PowerShell?

On Windows: Get-WinEvent -Path .\Security.evtx | Select-Object TimeCreated, Id, ProviderName, Message | ConvertTo-Json | Out-File events.json. EventData stays inside the Message text unless you parse each event's XML yourself.

Can I load the JSON into a SIEM or Elastic?

Yes. Each object is self-contained with timestamp, Event ID, channel and fields, which maps directly onto most ingest pipelines. For large collections, evtx_dump -o jsonl streams line-delimited JSON that bulk loaders accept.

Is the conversion done on a server?

No. Parsing and conversion happen in a Web Worker inside your browser. The .evtx file is never transmitted.

Convert EVTX to JSON

Turn a Windows .evtx event log into structured JSON — ready for jq, Python, a notebook or a SIEM ingest pipeline — directly in your browser. The same Rust parser behind evtx_dump runs locally as WebAssembly, so the file never leaves your device.

Open the EVTX to JSON converter ↗

What the JSON contains

One object per event

The export is an array with one object per event: record_id, timestamp, level, event_id, provider, channel, computer, an event_data object holding every EventData field, and the full event xml.

{
  "record_id": 48213,
  "timestamp": "2026-09-12T08:14:03.512Z",
  "event_id": 4624,
  "channel": "Security",
  "event_data": { "LogonType": "10", "TargetUserName": "j.doe" },
  "xml": "<Event xmlns=…>…</Event>"
}

Multi-file aware

Load several .evtx files at once and each object gets a source_file field, so a combined export still tells you where each event came from.

Filtered exports

Only the rows that match your current filter are exported, which keeps a triage extract small enough to share or diff.

How to convert EVTX to JSON

1
Open the converterOpen the EVTX parser homepage. The WebAssembly parser loads in your tab; nothing is uploaded.
2
Drop your .evtx fileDrag one or more .evtx files onto the drop zone, or click to choose them.
3
Filter, then Export JSONNarrow the events if you like, then click Export JSON. The .json file downloads locally.

EVTX to JSON FAQ

How do I convert EVTX to JSON from the command line?: Use evtx_dump from the omerbenamram/evtx project: evtx_dump -o json Security.evtx > events.json, or -o jsonl for one event per line. This site runs the same parser in the browser when you don't want to install anything.
How do I convert EVTX to JSON with PowerShell?: On Windows: Get-WinEvent -Path .\Security.evtx | Select-Object TimeCreated, Id, ProviderName, Message | ConvertTo-Json | Out-File events.json. EventData stays inside the Message text unless you parse each event's XML yourself.
Can I load the JSON into a SIEM or Elastic?: Yes. Each object is self-contained with timestamp, Event ID, channel and fields, which maps directly onto most ingest pipelines. For large collections, evtx_dump -o jsonl streams line-delimited JSON that bulk loaders accept.
Is the conversion done on a server?: No. Parsing and conversion happen in a Web Worker inside your browser. The .evtx file is never transmitted.