Get-WinEvent -LogName System -MaxEvents 2000 -ErrorAction SilentlyContinue |
  Where-Object { $_.TimeCreated -gt [datetime]'2026-05-14 18:00:00' -and
                 $_.TimeCreated -lt [datetime]'2026-05-15 02:00:00' -and
                 $_.Id -in @(1074,6006,6008,6009,41,7034,7035,7036,7040,4625,4634) } |
  Select-Object TimeCreated,Id,LevelDisplayName,@{n='Summary';e={$_.Message -split "`n" | Select-Object -First 2 | Join-String -Separator ' '}} |
  Sort-Object TimeCreated |
  ConvertTo-Json -Depth 2