[Solved] Get-WinEvent returns messages with three dots

When you display log entries with Get-WinEvent, you may see some empty lines with only three dots.

Event log empty three dot

This happens because the first line of the message is empty, and Windows wants to show that there is more data after this empty line.

Event empty line

To see the whole message, pipe your events to the Format-List cmdlet.

Get-WinEvent -LogName System -MaxEvents 20 |Format-List

One thought on “[Solved] Get-WinEvent returns messages with three dots

  1. Hi Luce,
    There is more elegant solution using calculated property.
    The first -replace converts multiline messages to one line, replacing Enter with a Space character.
    The second -replace removes all leading spaces in every Message property.
    This approach allows you to send your output wherever you want | ogv, | ft, | fl, | epcsv, etc.
    Get-WinEvent -LogName System -MaxEvents 1000 | select TimeCreated, Id, LevelDisplayName, @{N=’FormattedMessage’; E={$_.Message -replace “rn”, ‘ ‘ -replace ‘^\s+’, $null}} | Out-GridView


Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s