Windows Event Log (EVTX) to CSV Converter

Windows stores events in the binary EVTX format, but the practical way to get them out for analysis is XML — from Event Viewer’s “Save All Events As XML” on a filtered custom view, or wevtutil epl Security security.xml from an elevated prompt. That XML is verbose and deeply nested — every field of interest is buried a few levels down inside a <System> header and an <EventData> payload — so analysts, SOC playbooks and SOAR pipelines almost always reach for a flat table instead. Windows Event Log to CSV Converter turns an event XML export into a clean, analysis-ready CSV in one paste, entirely in your browser.

Every <Event> element is parsed independently: the <System> header yields the EventID, the numeric Level plus its human-readable name (Critical, Error, Warning, Information, Verbose — decoded per the standard Windows eventing level values, not just guessed from context), Provider, TimeCreated, Computer, Channel, the Security user SID, Task, Opcode, Keywords and the EventRecordID. The <EventData> payload — which varies field-by-field depending on the EventID, since a logon event and a service-change event carry completely different data — is expanded so each named <Data Name="..."> element (SubjectUserName, TargetUserName, IpAddress, LogonType, and dozens of others depending on the event source) becomes its own column, collected in first-seen order across the whole export so the column set reflects exactly what appeared in your paste. Older or third-party providers that emit unnamed <Data> elements (no Name attribute) still get captured, numbered data_1, data_2 and so on in document order, so nothing from the payload is silently dropped.

Output is RFC 4180 CSV with your choice of comma, semicolon, tab or pipe delimiter — semicolon matters if your Excel locale treats comma as a decimal separator, tab (TSV) avoids quoting entirely for most values, and pipe is a common SIEM ingestion convention. Values containing the delimiter, a double quote, or an embedded newline (multi-line EventData values do happen, e.g. command lines or stack-like payloads) are quoted and escaped correctly so the file re-opens cleanly in Excel, a script, or a database loader. If you don’t want one column per field, turning off “Expand EventData as columns” packs the whole payload into a single JSON-encoded event_data column instead — useful when the field set varies too much across event types to make a stable column layout practical. Everything runs locally: paste, convert, copy or download — nothing is uploaded.

• Event XML parsing: Event Viewer “Save All Events As XML” and wevtutil epl exports both supported.
• System fields: EventID, level, provider, timestamp, computer, channel, user SID, task, opcode, keywords, record ID.
• Named levels: Critical, Error, Warning, Information and Verbose decoded from the standard numeric Level values.
• EventData expansion: every named Data element becomes its own CSV column, in first-seen order.
• Unnamed data: data_1, data_2… for elements without a Name attribute, so nothing is dropped.
• Four delimiters: comma, semicolon, tab or pipe for any regional or toolchain preference.
• RFC 4180 quoting: quotes, delimiters and embedded newlines handled safely.
• Header toggle: include or omit the header row.
• Compact mode: pack EventData into one JSON column when the field set varies too much for stable columns.
• Sample data: realistic Security and System events, including unnamed Data elements, in one click.
• Local processing: everything runs in your browser, nothing uploaded.

1. Export events to XML. In Event Viewer, right-click a log or filtered view and choose Save All Events As…, pick XML, or run wevtutil epl Application app.xml (or Security, System, any channel name) from an elevated prompt, and open the resulting file.
2. Paste the XML. Drop the export — the whole <Events>...</Events> document or just a handful of <Event> elements — into the input box, or click Load sample.
3. Set options. Choose a delimiter (comma, semicolon, tab or pipe), decide whether to expand EventData into individual columns or pack it as one JSON column, and whether to include the header row.
4. Convert. A CSV table appears in the output box with an event count, column count and byte count; it also refreshes automatically as you edit the input or change options.
5. Copy or download. Copy the CSV to the clipboard, or download it as a .csv file to open in Excel, load into a SIEM, or hand to a script.

Example 1 — Security audit export. Save the Security log as XML and convert to CSV. Expand EventData to get SubjectUserName, TargetUserName, LogonType and IpAddress as their own columns for a 4624/4625 logon review, then filter in Excel or jq.

Example 2 — wevtutil pipeline. Dump Application events with wevtutil epl Application app.xml, convert to TSV, and load into a SIEM or spreadsheet without writing a custom XML parser.

Example 3 — Incident timeline. Convert Security, System and Application exports separately, sort each CSV by the time column, and line up logon, service and error events chronologically to reconstruct what happened during an incident.

Example 4 — SOAR integration. Convert a logon-event export to pipe-delimited CSV and hand it to an automation playbook that expects a flat table with one row per event and predictable column names.

Example 5 — Analysis in Excel. Use semicolon-delimited output for regional Excel settings where comma is the decimal separator, then pivot by EventID, level_name or Computer to spot the noisiest event source.

Example 6 — Legacy providers with unnamed data. An older provider like Service Control Manager (EventID 7040) often logs <Data> elements with no Name attribute; those still show up as data_1, data_2 columns instead of being lost.

• No parser to write: System header and EventData handled automatically, however many events you paste.
• Full field coverage: 12 System columns plus every payload field, named or not.
• Analysis-ready: clean columns, correctly decoded severity levels, first-seen ordering.
• Delimiter choice: comma, semicolon, tab or pipe for any toolchain or regional Excel setup.
• Multi-line safe: RFC 4180 quoting keeps multi-line payload values intact.
• Private by design: data is processed locally and never uploaded.