From 65a6acc0beb99acf07ca3378a7d53e7aaacc6ac7 Mon Sep 17 00:00:00 2001
From: itsscb <dev@itsscb.de>
Date: Wed, 17 Jul 2024 15:24:03 +0200
Subject: [PATCH] v0.1.1 + adds example to README

---
 Cargo.toml |  2 +-
 README.md  | 38 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index a87ea01..12a07fc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "tracing-layer-win-eventlog"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 author = ["itsscb <dev@itsscb.de>"]
 description = "Layer for the tracing_subscriber to write to the Windows EventLog"
diff --git a/README.md b/README.md
index a20d14c..9e597b0 100644
--- a/README.md
+++ b/README.md
@@ -2,17 +2,53 @@
 Layer for the *tracing_subscriber* to write to the Windows EventLog
 
 ## Usage
+
+If the Windows EventLog does not yet exist, it has to be created first.
+```powershell
+# PowerShell v5.1 running as Administrator
+New-EventLog -LogName Application -Source hello_world
+
+```
+
 ```rust
 use tracing_subscriber::{layer::SubscriberExt as _, util::SubscriberInitExt as _};
 
 fn main() {
     println!("Hello, world!");
 
+    let eventlog = tracing_layer_win_eventlog::EventLogLayer::new("hello_world".to_owned());
+
     tracing_subscriber::registry()
-        .with(tracing_layer_win_eventlog::EventLogLayer)
+        .with(eventlog)
         .init();
 
     tracing::info!(id = 40, "hello world!");
 }
 
 ```
+
+The `id` is optional and used as the Windows EventID and has to be `unsigned`. If no `id` is given, the `tracing::Level` will be used as the EventID.
+
+The parent spans are listed above the message in the `source` key. If there are multiple parent spans they are concatenated with the `/` separator.
+
+All other objects that are passed are written below the message in a `key: value` pair.
+
+### Example
+
+```rust
+#[tracing::instrument]
+fn windows() {
+    let path = "C:\\Windows";
+    tracing::debug!(id=2,?path,"currently in windir");
+}
+```
+
+The above example will be written to the EventLog as follows:
+```
+ID: 2
+
+source: windows
+message: currently in windir
+path: "\"C:\\Windows\""
+
+```