How do I convert EVTX to TXT with wevtutil?

On Windows: wevtutil qe C:\path\Security.evtx /lf:true /f:text > events.txt. The /lf:true switch tells wevtutil the argument is a log file rather than a live channel. It needs a Windows host with the matching provider manifests to render message text.

Can Event Viewer export an EVTX file to text?

Yes: open the saved log, choose Save All Events As… and pick Text (Tab delimited). You get summary columns plus the rendered message, without the individual EventData fields.

Why can't I just open an EVTX file in Notepad?

EVTX is a binary format: 64 KB chunks of BinXML records that reference shared templates. The text only exists after a parser rebuilds each record, which is what this converter does.

Does the TXT export include the event message?

It includes every structured field of the event. The friendly Message sentence Event Viewer shows is built from provider DLLs installed on Windows, so it is not stored in the .evtx and no offline parser can reproduce it exactly.

Convert EVTX to TXT (plain text)

An .evtx file is binary, so Notepad shows garbage. This converter turns it into a readable .txt file — one block per event with its time, Event ID, provider and every EventData field — right in your browser. Nothing is uploaded and nothing needs to be installed.

Open the EVTX to TXT converter ↗

What the text file looks like

One block per event

Each event starts with a header line — record number, timestamp, level and Event ID — followed by provider, channel and computer, then one indented line per EventData field. Events are separated by a blank line.

Record #48213 | 2026-09-12T08:14:03.512Z | Information | Event ID 4624
Provider: Microsoft-Windows-Security-Auditing
Channel: Security
Computer: WS-042.corp.local
  LogonType: 10
  TargetUserName: j.doe
  IpAddress: 203.0.113.17

Made for grep and reports

Plain text works with grep, findstr, diff and any editor, and pastes cleanly into a ticket or an incident report. Filter first so the file only contains the events that matter.

Raw XML when you need it

Tick “Raw XML column” before exporting and each block also includes the event's full <Event> XML.

How to convert EVTX to TXT

1
Open the converterOpen the EVTX parser homepage. Parsing runs in your browser tab through WebAssembly.
2
Drop your .evtx fileDrag one or more .evtx files onto the drop zone, or click to choose them.
3
Filter, then Export TXTUse the filter bar, Event ID chips or timeline to keep only relevant events, then click Export TXT. The .txt file downloads locally.

EVTX to TXT FAQ

How do I convert EVTX to TXT with wevtutil?: On Windows: wevtutil qe C:\path\Security.evtx /lf:true /f:text > events.txt. The /lf:true switch tells wevtutil the argument is a log file rather than a live channel. It needs a Windows host with the matching provider manifests to render message text.
Can Event Viewer export an EVTX file to text?: Yes: open the saved log, choose Save All Events As… and pick Text (Tab delimited). You get summary columns plus the rendered message, without the individual EventData fields.
Why can't I just open an EVTX file in Notepad?: EVTX is a binary format: 64 KB chunks of BinXML records that reference shared templates. The text only exists after a parser rebuilds each record, which is what this converter does.
Does the TXT export include the event message?: It includes every structured field of the event. The friendly Message sentence Event Viewer shows is built from provider DLLs installed on Windows, so it is not stored in the .evtx and no offline parser can reproduce it exactly.