title: How to get the template for a windows event log message
body: <p>I want to read an archived Windows event log file (<code>.evtx</code>), like in this example:</p>
  
  <pre><code>using System;
  using System.Diagnostics.Eventing.Reader;
  
  public static class Program {
      static void Main(string[] args) {
          using (var reader = new EventLogReader(@"C:\tmp\some-log.evtx", PathType.FilePath)) {
              EventRecord record;
              while ((record = reader.ReadEvent()) != null) {
                  // do something with record...
              }
          }
      }
  }
  </code></pre>
  
  <p>The <code>record</code> object has a <code>Properties</code> list that contains the replacement strings for the event:</p>
  
  <pre><code>foreach (var property in record.Properties) {
      Console.WriteLine(property.Value);
  }
  </code></pre>
  
  <p>If I open the <code>.evtx</code> file in the event log viewer, I can see a full description for the event, which is like a base template message (which should come from a resources file associated to the application that generated the event) with the values for the placeholders replaced with those values:</p>
  
  <p><a href="https://i.stack.imgur.com/KROSE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/KROSE.png" alt="enter image description here"></a></p>
  
  <p>Is there a way I can get this "message template" for a certain event?</p>