title: Retrive event logs contains specific string in DATA tag
body: <p>I have developed a <code>MFC</code> application which reads <code>windows event logs</code> from <code>event log file</code> (<code>EVTX</code>) file and parse it to render in application</p>
  
  <p>For reading log file, I am using <code>XPATH</code> query to retrieve specific event logs from <code>event log file</code> file consist of 40000 records</p>
  
  <p>Sample log records look like below code</p>
  
  <pre><code>&lt;Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"&gt;
    &lt;System&gt;
      &lt;Provider Name="Error_Log"/&gt;
      &lt;EventID Qualifiers="20225"&gt;6002&lt;/EventID&gt;
      &lt;Level&gt;4&lt;/Level&gt;
      &lt;Task&gt;0&lt;/Task&gt;
      &lt;Keywords&gt;0x80000000000000&lt;/Keywords&gt;
      &lt;TimeCreated SystemTime="2018-05-31T10:37:16.000000000Z"/&gt;
      &lt;EventRecordID&gt;11679958&lt;/EventRecordID&gt;
      &lt;Channel&gt;Application&lt;/Channel&gt;
      &lt;Security/&gt;
    &lt;/System&gt;
    &lt;EventData&gt;
      &lt;Data&gt;16:07:16.339:(A)[app.exe] [scan] m_id = [1254]&lt;/Data&gt;
      &lt;Binary&gt;31363A30373A31362E3333393A2841295B7275706170702E6578655D205B5363616E5D206D5F6964203D205B313235345D&lt;/Binary&gt;
    &lt;/EventData&gt;
  &lt;/Event&gt;
  </code></pre>
  
  <p>Here I want to retrieve only those log records where <code>&lt;DATA&gt;</code> tag contains sub-string value <code>m_id</code>. To achieve this I tried below <code>query</code>   </p>
  
  <pre><code>LPWSTR Query = _T("Event/EventData[Data(Data='m_id')]");
  
  EVT_HANDLE Results = EvtQuery(NULL, Path, Query, EvtQueryFilePath | EvtQueryForwardDirection);  
  </code></pre>
  
  <p>But I am not able to retrieve any logs even if string <code>m_id</code> is present in input log file as shown in above code</p>