$ev = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Application Error'} -MaxEvents 30 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'gui_probe' } | Select-Object -First 3
$out = foreach ($e in $ev) { "$($e.TimeCreated)" + "`n" + $e.Message + "`n====" }
$out | Out-File -FilePath 'debug/evt_out.txt' -Encoding utf8