To filter the Windows Event Log based on a given keyword…

<QueryList>
 <Query Id="0" Path="System">
 <Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Power-Troubleshooter']
 and (EventID=1)]] and *[EventData[Data[15]='USB Root Hub']]</Select>
 </Query>
</QueryList>

to adapt this query only change the data id (can be seen out of the detailed xml view of the eventlog entry