title: Using XPath starts-with or contains functions to search Windows event logs
body: <p>By editing the XML filter query manually in Windows event viewer, I can find events where the data matches a string exactly:</p>
  
  <pre><code>&lt;QueryList&gt;
    &lt;Query Id="0" Path="Application"&gt;
      &lt;Select Path="Application"&gt;*[EventData[Data and (Data="Session end: imzcjflrrsq1sfdk3okc4jpf")]]&lt;/Select&gt;
    &lt;/Query&gt;
  &lt;/QueryList&gt;
  </code></pre>
  
  <p>Now, I want to do a partial match:</p>
  
  <pre><code>&lt;QueryList&gt;
    &lt;Query Id="0" Path="Application"&gt;
      &lt;Select Path="Application"&gt;*[EventData[Data and (Data[starts-with(.,"Session")])]]&lt;/Select&gt;
    &lt;/Query&gt;
  &lt;/QueryList&gt;
  </code></pre>
  
  <p>Event log gives me the error:</p>
  
  <blockquote>
    <p>The specified query is invalid</p>
  </blockquote>
  
  <p>Do I have the syntax wrong?</p>