The only tokens that I see for Windows event log are: %capture[category] %capture[computername] %capture[logfile] %capture[sourcename] %capture[timewritten] %capture[user] Is there any way to retrieve Type and EventID?