#Require -RunAsAdministrator
#Require -version 7
set-strictmode -version 4

[uint32]$ms=5*24*60*60*1000;
$start = (Get-Date).AddMilliseconds(-$ms);
$end = (Get-Date).AddMilliSeconds(-1000);

$start2=$start.ToString("yyyy-MM-dd_HHmmss")
$end2=$end.ToString("yyyy-MM-dd_HHmmss")

$scriptName="EventLog-Parallel"
$homeDir="FileSystem::$env:HOMEDRIVE\SCRIPTS\$scriptName"

If( !(test-path $homeDir -pathtype container ) )
{
	new-item $homedir -itemtype directory | out-null
}

[System.Collections.Hashtable]$query = @{}

$query.SystemError = @{ LogName = 'System'; Level = 2; StartTime = $start; EndTime = $end }
$query.SystemWarning = @{ LogName = 'System'; Level = 3; StartTime = $start; EndTime = $end }
$query.SystemInformation = @{ LogName = 'System'; Level = 4; StartTime = $start; EndTime = $end }

$query.ApplicationError = @{ LogName = 'Application'; Level = 2; StartTime = $start; EndTime = $end }
$query.ApplicationWarning = @{ LogName = 'Application'; Level = 3; StartTime = $start; EndTime = $end }
$query.ApplicationInformation = @{ LogName = 'Application'; Level = 4; StartTime = $start; EndTime = $end }

$query.Security = @{ LogName = 'Security'; Level = 0; StartTime = $start; EndTime = $end }

$error.clear()

$query.values | ForEach-Object -Parallel{

		If($_.logname -eq 'System' -AND $_.level -eq '2')
		{ $outFile="$($homeDir)\SystemError_$($start2).json"}

		If($_.logname -eq 'System' -AND $_.level -eq '3')
		{ $outFile="$($homeDir)\SystemWarning_$($start2).json"}

		If($_.logname -eq 'System' -AND $_.level -eq '4')
		{ $outFile="$($homeDir)\SystemInformation_$($start2).json"}

		If($_.logname -eq 'Application' -AND $_.level -eq '2')
		{ $outFile="$($homeDir)\ApplicationError_$($start2).json"}

		If($_.logname -eq 'Application' -AND $_.level -eq '3')
		{ $outFile="$($homeDir)\ApplicationWarning_$($start2).json"}

		If($_.logname -eq 'Application' -AND $_.level -eq '4')
		{ $outFile="$($homeDir)\ApplicationInformation_$($start2).json"}

		If($_.logname -eq 'Security')
		{ $outFile="$($homeDir)\Security_$($start2).json"}


	Try{

		Get-WinEvent -FilterHashTable $_ -EA STOP | select timecreated,logname,providername,id,recordid,message | convertto-json | out-file $outFile -Force -confirm:$false

	}
	Catch [system.exception]{

		#No events found
		$null | convertto-json | out-file $outFile -Force -confirm:$false
	}
	Catch{

		$null | convertto-json | out-file $outFile -Force -confirm:$false
	}

}#Foreach

If($error.count -gt 0){ $e=$error ; $e | foreach{$_;} }