Source/Tx.Windows.Logs/EvtxManifestTypeMap.cs (38 lines of code) (raw):

// Copyright (c) Microsoft Open Technologies, Inc. All rights reserved. See License.txt in the project root for license information. using System; using System.Collections.Generic; using System.Diagnostics.Eventing.Reader; using System.Reactive; using System.Reflection; namespace Tx.Windows { public class EvtxManifestTypeMap : EvtxTypeMap, IPartitionableTypeMap<EventRecord, ManifestEventPartitionKey> { private readonly ManifestEventPartitionKey.Comparer _comparer = new ManifestEventPartitionKey.Comparer(); public IEqualityComparer<ManifestEventPartitionKey> Comparer { get { return _comparer; } } public ManifestEventPartitionKey GetInputKey(EventRecord evt) { return new ManifestEventPartitionKey { EventId = (ushort) evt.Id, ProviderId = evt.ProviderId.HasValue ? evt.ProviderId.Value : Guid.Empty, // looks like in evtx files we can also have name instead of Guid? Version = evt.Version.HasValue ? evt.Version.Value : (byte) 0 }; } public ManifestEventPartitionKey GetTypeKey(Type outputType) { var eventAttribute = outputType.GetTypeInfo().GetCustomAttribute<ManifestEventAttribute>(); if (eventAttribute == null) return null; return new ManifestEventPartitionKey { ProviderId = eventAttribute.ProviderGuid, EventId = (ushort) eventAttribute.EventId, Version = eventAttribute.Version }; } } }