rgrep.1 -E '^\$.*replace' powershell.evtx.log
print lines matching a pattern
source manpages: rgrep