How to set up Powershell where-object for filtering EventLog

Question

In interactive mode, this works:

Get-Eventlog -log application -after ((get-date).addMinutes(-360)) -EntryType Error

Now I want to filter out certain messages, the following didn't filter the desired word:

Get-Eventlog -log application -after ((get-date).addMinutes(-360)) -EntryType Error | where-object  {$_.$Message -notlike "*Monitis*"}

Also, how do I put in multiple conditions on the where-object?

In my script, I'm getting errors on the -and statement:

$getEventLog = Get-Eventlog -log application -after ((get-date).addMinutes($minutes*-1)) -EntryType Error 
# list of events to exclude 
$getEventLogFiltered = $getEventLog | where-object {$_.Message -notlike "Monitis*" 
                                       -and $_.Message -notlike "*MQQueueDepthMonitor.exe*"
                                       }
$tableFragment = $getEventLogFiltered | ConvertTo-Html -fragment

Error:

-and : The term '-and' is not recognized as the name of a cmdlet, function, script file, or operable program. Check
the spelling of the name, or if a path was included, verify that the path is correct and try again.
At D:\scripts\EventLogExtract2.ps1:24 char:40
+                                        -and $_.Message -notlike "*MQQueueDepthMo ...
+                                        ~~~~

Today, the first part seems to be working (the -notlike). Maybe I had some other timing issue or problem with the -after clause when I ran it yesterday. — NealWalters
– NealWalters, Commented Jun 20, 2013 at 16:55
Apparently, you cannot put a line break between each -and? It seems to work if I put all my and statements on one line. But this makes the code very hard to read/maintain. I might eventually have 10 -and statements. Perhaps I should just use consecutive pipes? — NealWalters
– NealWalters, Commented Jun 21, 2013 at 14:07

dliverpool · Accepted Answer · 2013-06-25 16:29:12Z

4

In your 2nd code snippet remove the dollar sign right before "Message". Reads like the following. If you're using PowerShell ISE, you'll see that "Message" should be in black instead of red.

Get-Eventlog -log application -after ((get-date).addMinutes(-360)) -EntryType Error | where-object  {$_.Message -notlike "*Monitis*"}

For the 3rd code snippet, I placed a grave accent before starting a newline in the Where-Object filter. This tells PowerShell you're continuing a line instead of beginning a new one. Also, in PowerShell ISE, the comparison operators (-and & -notlike) turn from blue and black to grey.

$getEventLog = Get-Eventlog -log application -after ((get-date).addMinutes($minutes*-1)) -EntryType Error 
# list of events to exclude 
$getEventLogFiltered = $getEventLog | where-object {$_.Message -notlike "Monitis*" `
                                       -and $_.Message -notlike "*MQQueueDepthMonitor.exe*"
                                       }
$tableFragment = $getEventLogFiltered | ConvertTo-Html -fragment

answered Jun 25, 2013 at 16:29

dliverpool

1013 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

NealWalters Over a year ago

Gee Whiz - haven't seen a language in years that needed a continuation character! Ah, I see the extra $ sign now, duh... Thanks

Nicholas Leader · Accepted Answer · 2015-10-02 13:23:42Z

0

Date simplification: ((get-date).addMinutes($minutes*-1)) has the same output of ((get-date).addMinutes(-1)) and the same output of (get-date).addMinutes(-1)

Also I find addDays(-1) to be more useful.

answered Oct 2, 2015 at 13:23

Nicholas Leader

754 bronze badges

2 Comments

rob Over a year ago

Nice comment but should not posted as an answer

Nicholas Leader Over a year ago

"You must have 50 reputation to comment" I think was my reasoning to put this as an answer -- I suppose I could have waited.

Collectives™ on Stack Overflow

How to set up Powershell where-object for filtering EventLog

2 Answers 2

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related