Powershell: Why group System.Diagnostics.Eventing.Reader.EventLogRecord?

[Bartolomeus-649]

Regarding _Event.format.ps1xml_ and why someone thought it would be a good idea to group on ProviderName when displaying _System.Diagnostics.Eventing.Reader.EventLogRecord_'s.

As far as I can see EventLogRecord is a pretty straight forward class with a bunch of properties, one of them being a collection of "properties".

Is there a reason to not just display this as a plain table?
It's not so easy to get rid of the grouping, but on the other hand, for those that want grouping it it is right there in Select-Object.

[SteveL-MSFT]

I don't know the historical reason why it groups by default, but I agree it seems like not grouping would be more useful.

PS C:\Users\slee> get-winevent -LogName application


   ProviderName: Windows Error Reporting

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
6/20/2017 4:14:21 PM          1001 Information      Fault bucket 127927607110, type 5...
6/20/2017 4:14:20 PM          1001 Information      Fault bucket , type 0...
6/20/2017 4:14:20 PM          1001 Information      Fault bucket , type 0...


   ProviderName: Microsoft-Windows-Security-SPP

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
6/20/2017 4:14:14 PM         16384 Information      Successfully scheduled Software Protection service for re-start ...


   ProviderName: Windows Error Reporting

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
6/20/2017 4:14:05 PM          1001 Information      Fault bucket 127927606267, type 5...
6/20/2017 4:12:53 PM          1001 Information      Fault bucket 127927607110, type 5...
6/20/2017 4:12:51 PM          1001 Information      Fault bucket , type 0...
6/20/2017 4:12:51 PM          1001 Information      Fault bucket , type 0...

compared to

PS C:\Users\slee> get-winevent -LogName application  | select timecreated,id,leveldisplayname,message

TimeCreated             Id LevelDisplayName Message
-----------             -- ---------------- -------
6/20/2017 4:14:21 PM  1001 Information      Fault bucket 127927607110, type 5...
6/20/2017 4:14:20 PM  1001 Information      Fault bucket , type 0...
6/20/2017 4:14:20 PM  1001 Information      Fault bucket , type 0...
6/20/2017 4:14:14 PM 16384 Information      Successfully scheduled Software Protection service for re-start at 2017-...
6/20/2017 4:14:05 PM  1001 Information      Fault bucket 127927606267, type 5...
6/20/2017 4:12:53 PM  1001 Information      Fault bucket 127927607110, type 5...
6/20/2017 4:12:51 PM  1001 Information      Fault bucket , type 0...
6/20/2017 4:12:51 PM  1001 Information      Fault bucket , type 0...
6/20/2017 4:12:51 PM   916 Information      svchost (5616,G,0) The beta feature EseDiskFlushConsistency is enabled i...
6/20/2017 4:12:34 PM  1001 Information      Fault bucket 127927606267, type 5...
6/20/2017 4:10:50 PM    15 Information      Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
6/20/2017 4:10:50 PM    15 Information      Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
6/20/2017 4:08:39 PM 16384 Information      Successfully scheduled Software Protection service for re-start at 2017-...
6/20/2017 4:07:59 PM  1001 Information      Fault bucket 127911070002, type 5...

cc @joeyaiello @HemantMahawar

Since it's formatting, it wouldn't be a breaking change.

[iSazonov]

It looks as a emulation of MMC Event Viewer main page.

[SteveL-MSFT]

When we eventually get curses support, we could do some interesting things with viewing object collections

[iSazonov]

I think the MMC Event Viewer main page and the group view is very useful when we don't know where to start to troubleshoot. an Windows issue. In other cases, we are usually more precise about the event selection. So I'd leave it as is.

[SteveL-MSFT]

Perhaps the simply thing to do here is to add a new View so you can do something like:

Get-WinEvent -LogName Application | Format-Table -View Flat

[Bartolomeus-649]

Why not make it behave like all other CmdLets? Are there any other similar CmdLets that group their output by default? Are there any other CmdLets from Microsoft.PowerShell.Diagnostics that group the output by default?

Also, doing what people expect and adhearing to the Principle of least astonishment is always a good thing.

And if keeping the grouped by output, then Get-EventLog need to be changed to group it's output as well, if there is to be a consistent and predictable result.

Also, note that the group by "feature", is not a "real" group by. As you can see in @SteveL-MSFT initial response, the ProviderName Windows Error Reporting is present two times in the output.

[ghost]

Get-ChildItem groups their output by default based on directory. There are times when you want it flat too so I up-voted the Format-Table -View Flat option.

The Grouping of Get-WinEvent is not all confusing to me. It is grouping based on the type of log, because each one is a different source, a different file. It seems to mirrors the MMC output which is tree-based navigation, much like Get-ChildItem with file system.

The cool thing about PowerShell is that once you understand that PSObject and Formatting are two separate things, stuff like this don't matter. Consistency is not a good thing when you need output to format differently based on the data. PowerShell tries to be smart about it with default Format Views. Then, if you don't like it, you just pipe to Format-Table or Format-List and change the fields and view.