Module xm_charconv Module xm_json define GroupPolicy /(?x)\w+\((?[\w\d]{3,4}). \ (?[\w\d]{3,4})\)\s+ \ (?[\d\:]+)\s+ \ (?.*)/ Module im_file File 'C:\Windows\debug\usermode\gpsvc.log' File 'C:\Windows\debug\usermode\gpmc.log' #Query the current filename if file_name() =~ /^.*\\(.*)$/ $FileName = $1; # Convert character encoding from UTF-16LE to UTF-8 $raw_event = convert($raw_event, 'UTF-16LE', 'UTF-8'); #Parse $raw_event if $raw_event =~ %GroupPolicy% #Query year, month and day details from the current system $date = year(now()) + "-" + month(now()) + "-" + day(now()); #Parse the $date and $time, merge to $EventTime field $EventTime = parsedate($date + " " + $time); #Delete unnecessary fields delete($date); delete($time); #Format to_json(); to_json();