WindowsEventLogReader Controller Service
描述
以 XML 内容形式读取 Windows 事件日志数据，这些数据由 ConsumeWindowsEventLog、ParseEv
标签
属性
该组件没有必填或可选属性。
状态管理
该组件不存储状态。
受限 (Restricted)
该组件不受限。
提供的 Service API
RecordReaderFactory
详细说明
WindowsEventLogReader
说明
该 Controller Service 用于解析 XML 形式的 Windows 事件日志事件 （可能来自 ConsumeWindowsEventLog 或 ParseEvtx）。
输入 XML 示例
<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}"
EventSourceName="Service Control Manager"/>
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2016-06-10T22:28:53.905233700Z"/>
<EventRecordID>34153</EventRecordID>
<Correlation/>
<Execution ProcessID="684" ThreadID="3504"/>
<Channel>System</Channel>
<Computer>WIN-O05CNUCF16M.hdf.local</Computer>
<Security/>
</System>
<EventData>
<Data Name="param1">Smart Card Device Enumeration Service</Data>
<Data>param2</Data>
<Binary>5300630044006500760069006300650045006E0075006D002F0034000000</Binary>
</EventData>
</Event>
输出示例（使用 ConvertRecord 配合 JsonRecordSetWriter）
[
{
"System": {
"Provider": {
"Guid": "{555908d1-a6d7-4695-8e1e-26931d2012f4}",
"Name": "Service Control Manager"
},
"EventID": 7036,
"Version": 0,
"Level": 4,
"Task": 0,
"Opcode": 0,
"Keywords": "0x8080000000000000",
"TimeCreated": {
"SystemTime": "2016-06-10T22:28:53.905233700Z"
},
"EventRecordID": 34153,
"Correlation": null,
"Execution": {
"ThreadID": 3504,
"ProcessID": 684
},
"Channel": "System",
"Computer": "WIN-O05CNUCF16M.hdf.local",
"Security": null
},
"EventData": {
"param1": "Smart Card Device Enumeration Service",
"param2": "5300630044006500760069006300650045006E0075006D002F0034000000"
}
}
]