Written by Luke

[Solved] Get-WinEvent returns messages with three dots

When you display log entries with Get-WinEvent, you may see some empty lines with only three dots.

Event log empty three dot

This happens because the first line of the message is empty, and Windows wants to show that there is more data after this empty line.

Event empty line

To see the whole message, pipe your events to the Format-List cmdlet.

Get-WinEvent -LogName System -MaxEvents 20 |Format-List

One thought on “[Solved] Get-WinEvent returns messages with three dots”

  1. Hi Luce,
    There is more elegant solution using calculated property.
    The first -replace converts multiline messages to one line, replacing Enter with a Space character.
    The second -replace removes all leading spaces in every Message property.
    This approach allows you to send your output wherever you want | ogv, | ft, | fl, | epcsv, etc.
    Get-WinEvent -LogName System -MaxEvents 1000 | select TimeCreated, Id, LevelDisplayName, @{N=’FormattedMessage’; E={$_.Message -replace “rn”, ‘ ‘ -replace ‘^\s+’, $null}} | Out-GridView

    Like

    Reply

Leave a comment