Windows 10 / 11 · x64
Download full installer
Full installer
Everything is inside, including the .NET runtime. Works on a machine with nothing installed, and on a locked-down PC where you cannot fetch a runtime.
LOGHARVEST Windows log exporter · part of the DataHaat suite
Get the log out of Event Viewer.
Pick the channels you care about, narrow them down to the hour and the keyword that matters, and hand someone a CSV, a JSON file or a PDF they can actually read. No more scrolling through Event Viewer on a call.
Free, no account
Signed installer
Keeps itself updated
Logs to export
System
Application
Security
Setup
[File] srv.evtx
ERRORDisk read timeout on \Device\Harddisk209:14
WARNService start took longer than expected09:12
ERRORApplication hang: ledger.exe not responding08:58
INFOScheduled backup completed08:30
WARNTime service could not reach the peer08:04
2,418 events · 23 Sep, 00:00 → now
CSVJSONHTMLPDF
Filtered 2,418 of 96,540 events
Download LogHarvest
Two installers. Pick by what the machine already has.
Both are the same application, signed the same way. They differ only in whether the .NET runtime travels with them.
Needs .NET Desktop Runtime 8
Download lite installer
Lite installer
Forty times smaller. If the runtime is missing, Setup offers to fetch it for you. Good for rolling out across machines you already manage.
Not sure which? Take the full installer. It is bigger, but it never asks the machine for anything. The lite one is worth it when you are installing on many machines, or when bandwidth matters more than the download size.
SHA-256 · full 7987b84efa9c5a77286fe125282a7abb203924c3c5ad1e2e620d6fdcd200fd76
SHA-256 · lite ded226a27230b171f05c87de92f1d78dcd511260b63f1c8292b3afdb6edacdff
Both are Authenticode-signed by Sanjivani Media and Technologies Private Limited — Windows will show that name in the install prompt.
What's inside
Everything Event Viewer makes hard.
Focused, not bloated — the DataHaat way. LogHarvest does one job: getting the right events out, in a form someone else can open.
Any log, or a file
Tick System, Application, Security or any channel on the machine — or drop in an .evtx file someone sent you.
Filter it down
Date and time range, level, event ID, provider — combine them until only the events that matter are left.
Search the message text
Include and exclude keywords, match any or all of them, case-sensitive when you need it — searching the rendered message, not just the metadata.
Four export formats
CSV for a spreadsheet, JSON for a script, HTML to open in a browser, PDF to attach to a ticket or a report.
The filter travels with it
Every export records exactly which logs and filters produced it, so nobody has to ask what they are looking at.
Keeps itself current
LogHarvest checks DataHaat for new releases and verifies what it downloads before installing it.
Your logs stay on the machine
Logs are read locally and written where you choose. Besides the update check, LogHarvest sends only an anonymous daily count — never anything about your logs. See exactly what
Free & signed
No cost, no account, no ads — and a properly signed installer, so it does not trip your own security policy.
How it works
Tick, filter, export.
Choose the logs
Tick the channels you want, or add an .evtx file. Show all channels if the one you need is not in the usual list.
Narrow it down
Set the window, the levels and the keywords. The count updates as you go, so you can see when you have the right slice.
Export and send
Save as CSV, JSON, HTML or PDF. The file carries the filter that produced it, so the person receiving it knows what they have.
Changelog
What's new
v1.0.023 Sep 2026
- First release
- Export from any Windows event log channel or an .evtx / .evt file
- Filter by date range, level, event ID, provider and message keywords
- Export to CSV, JSON, HTML and PDF, each carrying its filter summary
- Full and lite installers, both signed, with self-update built in
Privacy
What LogHarvest sends — and what it never does.
Apart from checking for updates, LogHarvest sends one thing: an anonymous count, about once a day, so we know how many machines run it and which versions are still in use. It is on unless you turn it off, and turning it off takes one click.
What is sent
A random ID this copy made up the first time it ran, the LogHarvest version, the Windows build number, whether the full or lite installer was used, and how many times it has started since it last reported.
What is never sent
Nothing about your logs — not which ones you read, what is in them, what you searched for, or what you exported and where. No computer name, user name or domain. The ID is random, never taken from the hardware.
Where it goes
To updatescannerapp.datahaat.com, alongside the update check to datahaat.com. We keep it against the random ID, by date only; the record holds no IP address.
Switching it off
In LogHarvest: Tools → Options → Privacy, then untick Send anonymous usage statistics. For a whole fleet, see below.
For administrators. A REG_DWORD value named UsageReporting set to 0 under HKLM\SOFTWARE\DataHaat turns it off for every DataHaat product on the machine; under HKLM\SOFTWARE\DataHaat\LogHarvest it turns off LogHarvest alone. The environment variable DATAHAAT_USAGE_REPORTING=0 does the same. Your setting overrides the user's. Blocking updatescannerapp.datahaat.com stops it too, without affecting updates. It is only ever sent with an update check, so with automatic checks turned off it goes only when someone chooses Help → Check for Updates.
What we keep. Daily records are deleted after about 13 months; what stays is a one-line summary per copy — first and last day seen, version, Windows build, installer type and total starts. Like any website, our servers also keep ordinary access logs, which do record the address a request came from. Questions: info@datahaat.com.
Stop screenshotting Event Viewer.
Free, signed, and it runs on the machine you are already standing at. Download it once and it keeps itself current.