Log Parsing via Powershell - print all array elements after nth element

Question

I'm parsing a log file that is space delimited for the first 7 elements and then a log message or sentence follows. I know just enough to get around in PS, and I'm learning more each day, so I'm not sure this is the best way to do this and apologies if I'm not leveraging a more efficient means that would be second nature to you. I'm using -split(' ')[n] to extract each field of the log file line by line. I'm able to extract the first parts fine as they are space-delimited, but I'm not sure how to get the rest of the elements up to the end of the line.

$logFile=Get-Content $logFilePath
$dateStamp=$logfile -split(' ')[0]
$timeStamp=$logfile -split(' ')[1]
$requestID=$logfile -split(' ')[3]
$binaryID=$logfile -split(' ')[4]
$logID=$logfile -split(' ')[5]
$action=$logfile -split(' ')[6]

$logMessage=$logfile -split(' ')[?]

This is not a CSV that I can import. I'm more familiar with string manipulation in bash so I am able to successfully replace spaces in the first 7 elements, and the end, with "," :

#!/bin/bash

inputFile="/cygdrive/c/Temp/logfile.log"
outputFile="/cygdrive/c/Temp/test_log.csv"

echo "\"DATE\",\"TIME\",\"HYPEN\",\"REQUESTID\",\"BINARY\",\"PROC_NUMBER\",\"MESSAGE\"" > $outputFile

while read -a line
do
        arrLength=$(echo ${#line[@]})
        echo \"${line[0]}\",\"${line[1]}\",\"${line[2]}\",\"${line[3]}\",\"${line[4]}\",\"${line[5]}\",\"${line[@]:6:$arrLength}\"
done < $inputFile >> $outputFile

Can you help either printing the array elements from position n to the end, or replacing the spaces appropriately in PS so I have a CSV that I can import? Just trying to avoid the two-step process of converting it in bash, then importing it in PS but I'm still researching. I did find this post Parsing Text file and placing contents into an Array Powershell for importing the file assuming it's space-delimited and that works for the first 7 elements but not sure about everything after that.

Of course I welcome any other PS solutions such as one of those [something]::SOMETHING things I've seen by googling that might do all this much more seamlessly.

Viktor Be · Accepted Answer · 2020-01-02 16:01:44Z

2

You can specify the maximum number of substrings in which the string is split like this:

$splittedRow = $logfile.split(' ',8)

$dateStamp=$splittedRow[0]
$timeStamp=$splittedRow[1]
$requestID=$splittedRow[3]
$binaryID=$splittedRow[4]
$logID=$splittedRow[5]
$action=$spltttedRow[6]

$logMessage=$splittedRow[7]

edited Jan 2, 2020 at 16:01

answered Jan 2, 2020 at 15:26

Viktor Be

7982 gold badges12 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

deskFan Over a year ago

This works best for me at this point. As I parse I'm storing the result of each variable into a New-Object System.Collections.ArrayList and then exporting the results to CSV. Thank you so much!

Viktor Be Over a year ago

Hey @deskFan. Im glad that my answer helped you! Can you please mark it as the best answer with the green check mark? Thanks!

hcm · Accepted Answer · 2020-01-02 15:50:33Z

1

As an addition to Viktor Be's answer:

$data = "111 22222 333 4444444 5 6 77 888888 9999999 0" #this is the content of file below for testing purposes
#$data = get-content -path C:\temp\mytest.txt

foreach ($line in $data){
    $splitted = $line.split(' ',8)
    $line_output= ""
    for ($i = 0;$i -lt 7;$i++){
        $line_output += "$($splitted[$i]);"
    }
    $line_output += $splitted[7]
    $line_output | out-file "C:\temp\MyCsvThatPowershellCanRead.csv" -append
}

answered Jan 2, 2020 at 15:50

hcm

1,0205 silver badges11 bronze badges

Comments

codewario · Accepted Answer · 2020-01-02 15:28:44Z

0

You should be able to iterate over each line in the logfile and get the information you need the way you are doing. However, it's easy to grab the message field, which could include n number of spaces in the log message with a regular expression.

The following regex should work for you. Assuming $line is the current line you are on:

$line -match '(?<=(\S+\s+){6}).*'
$logMessage = $matches[0]

The way this expression works is that it looks for .* (which means any character 0 or more times) that comes after 6 occurences of non-whitespace characters followed by whitespace characters. The .* in this expression should match on your log message.

answered Jan 2, 2020 at 15:28

codewario

21.9k25 gold badges107 silver badges179 bronze badges

Collectives™ on Stack Overflow

Log Parsing via Powershell - print all array elements after nth element

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related