Querying Windows event logs with Get-WinEvent -FilterHashtable and XPath

Goal

Retrieve targeted, machine-readable event log data from a Windows Server host in one call, without opening Event Viewer.

Prerequisites

Read access to the log (Administrators for the Security log); PowerShell 5.1 or later; for a remote query, WinRM already enabled on the target.

Steps

1. Filter by log, event ID, and time in one round trip: Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074,6008; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 100. -FilterHashtable is evaluated by the event log service itself, which is faster than pulling every record and filtering client-side.
2. For conditions the hashtable cannot express, such as a rolling time window combined with a level, use -FilterXPath: Get-WinEvent -LogName System -FilterXPath "*[System[(EventID=7034) and TimeCreated[timediff(@SystemTime) <= 86400000]]]".
3. Export a compact, structured result for downstream processing: Get-WinEvent -FilterHashtable @{LogName='System'; Id=6005,1074} | Select-Object TimeCreated, Id, LevelDisplayName, Message | ConvertTo-Json -Depth 3 | Out-File events.json -Encoding utf8.
4. Query a remote host non-interactively by adding -ComputerName SRV1 -Credential $cred to the same cmdlet, or wrap it in Invoke-Command.
5. On a Server Core box or in a minimal script context, wevtutil qe System /q:"*[System[(EventID=1074)]]" /f:text /c:20 gives the same filtering without loading the PowerShell diagnostics module.

Expected result

A JSON file or object array containing only the matching records with consistent fields, instead of a manual scroll through Event Viewer.

Limits and test basis

Only event IDs with a locatable primary source are named: 6005 and 1074 are grouped by Microsoft's own reboot-troubleshooting guide under "Review Event IDs 12, 13, 6005, and 6009 for reboot history" and a second set "Event IDs 13, 41, 1074, 6008, and 6009 to determine reboot types"; 6008 ("the previous system shutdown was unexpected") has its own Microsoft Support article; 7034 (a service "terminated unexpectedly") is documented for the OpenSSH Server service in a Microsoft troubleshooting article; 7031 ("Service Control Manager: unexpected service termination") appears in Microsoft's cluster-node-quarantine troubleshooting guide. No claim is made here about event ID 6006, since no primary Microsoft page defining it turned up during this review. -FilterHashtable cannot express arbitrary boolean logic across providers; fall back to -FilterXPath or run separate queries and merge in PowerShell. Both cmdlets are read-only, so nothing to undo or back up; no reboot or re-login required.