microsoft/EventLogExpert v26.5.1.960

v26.5.1.960

Repository: microsoft/EventLogExpert

Tag: v26.5.1.960

Published: 2026-05-01T16:26:29Z

Prerelease: yes

Release notes: _All changes since the last stable release (v26.3.5.912)._

Highlights

• Light mode is now available, with an option to follow the system theme (title bar included).
• Column drag-and-drop reordering in the event table, with persistent column sizing and ordering across sessions.
• MUI-aware event message resolution — events on international Windows installs (and from exported .evtx files with LocaleMetaData folders) now resolve correctly via .mui satellites instead of falling back to placeholders.
• Faster combined-events sorting via a k-way merge of pre-sorted per-log lists (replaces the full re-sort), and a cross-log `RecordId` equality bug is fixed.
• Filter pipeline overhaul — immutable BasicFilterSource / CompiledFilter model, signature-based change detection, parallel filtering above a threshold, and only-new-events filtering on arrival instead of re-filtering all active logs.
• Custom menu bar replaces the XAML one and simplifies context menus across the app.
• Accessibility infrastructure: skip link, live regions, focus-visible, reduced-motion, landmarks, role=button, non-color cues.
• Details pane height is now remembered as a user preference.
• DbTool now supports MTA files; added missing severity levels and additional event types / EvtVariantTypes for broader event coverage.
• Major memory and performance pass — pooled StringBuilder via thread-static cache, System.Text.Json source generators for provider DB serialization, IFormattable direct-write logging, primitive specializations on interpolated log handlers, and many smaller hot-path wins.

Features

• Light mode with follow-system-theme option, and the title bar honors the OS theme.
• Column drag-and-drop reordering in the event table, with persistent column sizing and ordering.
• Details pane height persisted as a user preference.
• XML resolution no longer requires the toggle — XML is automatically available, but only resolved when a filter actually needs it.
• Custom menu bar with templated menu items, replacing the XAML menu bar (also simplifies context menus).
• Improved keyboard navigation in the event table, with refactored event selection.
• `LogName` parser now creates folder structure that aligns with the MMC.
• Support for exported `LocaleMetaData` folders when resolving events from exported .evtx files.
• DbTool supports MTA files for provider details.
• Added missing severity levels so more events display the correct level.
• Added additional event types and EvtVariantTypes for broader event coverage.
• Title bar shows app name and version before log names.
• Markdown italics now render in release notes / in-app Markdown.

Filter Improvements

• New immutable filter model: `BasicFilterSource`, `CompiledFilter`, and a FilterCompiler replacing the old mutable FilterModel shape.
• `FilterEditorModel` split into Main + flat SubClauses with mutable draft types, leaving the persisted FilterModel immutable.
• Signature-based change detection computed during filter construction (no more refilter on UI flip).
• Parallel filtering above a threshold when combined event count is large; only-new-events filtering on arrival instead of re-filtering all active logs.
• `FilterCategoryEditor` items cached per ActiveLogs snapshot via ConditionalWeakTable to avoid per-render recomputation.
• `EventFilter.RequiresXml` precomputed at construction instead of scanned on every access.
• `FilterService.TryParse` string escaping now handles quotes, backslashes, and whitespace consistently across top-level, sub-filter, and MultiSelect paths.
• New-filter drafts now render as `FilterPane`-local / `FilterGroup`-local pending rows instead of dispatching IsEditing placeholders, with stale row state cleared on group collapse.
• Filters are now indexed so position in the pane is preserved.
• Generic `BaseFilterRow` / EditableFilterRowBase shares common row code; FilterGroup.SetFilter is now an upsert.
• Favorites import deduplication and filter group display rebuild consolidated and optimized.
• Date-range default logic moved into a single `DateRangeDefaults` helper.
• Filter spinner: replaced ToggleIsLoading with SetIsLoading and added a filter-generation guard for stale-result races.
• Retired FilterModel.IsEditing and the legacy in-state edit actions/reducers/effects; finalized init-only FilterModel fields.

Performance & Memory

• K-way merge of pre-sorted per-log lists for combined events (replaces full re-sort); per-log/combined default aligned to DateAndTime.
• Pooled `StringBuilder` via thread-static cache; replaced per-call format-token allocations with `IFormattable` direct paths, plus primitive specializations on logging interpolated handlers.
• `System.Text.Json` source generators for provider database DTO serialization.
• Streamed JSON directly to/from `GZipStream` in CompressedJsonValueConverter — eliminates intermediate string and byte[] allocations.
• Per-provider `Lazy` gates coalesce first-touch ProviderDetails work; replaced shared Registry.LocalMachine with an owned base key for parallel local resolution.
• Single-pass `GetKeywordsFromBitmask`: hoisted Keywords value, mask-gated the standard-keyword loop, replaced .Keys+indexer with KVP enumeration.
• `stackalloc` bounded in EventMethods native-render paths, with ArrayPool fallback above 4096 chars.
• `GetComparer` ascending/descending instances cached as static readonly singletons.
• `ScrollToSelectedEvent` collapsed from FirstOrDefault + IndexOf into a single indexed pass over DisplayedEvents.
• Multi-event clipboard copy reuses a single StringBuilder; replaced OwningLog.Split.Last with a LastIndexOf slice (also in the row template).
• Deferred `KeywordsDisplayName` join until first read.
• Rotating cache for NTStatus and HResult lookups.
• Caches are instance-based so they release at end of life cycle.
• Faster event table loading (batch loading + improved indexing).
• Refactored string cache and keywords display (created on init instead of per call); consolidated to IReadOnlyList and…