Powershell正则表达式未触发

Question

I'm having a problem getting a Regex to extract a portion of a string and I can't see what I have done wrong.

The string:

Backup job DailyBackupToNAS completed successfully.   Destination: Network location Start time: 01/05/2013 05:00:28 End time: 01/05/2013 05:39:13 Duration: 00:38:45.5875346

The code:

$destinationregex = "Destination: (.*)Start time:"
If ($message -match $destinationregex)
{
    $destination = $matches[1]
}

I am trying to extract the text Network Location

Any pointers would be appreciated!

As requested a fuller scope of code $events = get-eventlog application -source BackupAssist -newest 50

Foreach ($event in $events)
{
  $message = $event.message
  $destinationregex = "Destination: (.*)Start time:"
  If ($message -match $destinationregex)
  {
    $destination = $matches[1]
  }
  Else
  {
    $destination = "Unknown"
  }
  Write.Host $destination
}

Answer 1

Okay, I'm posting as an answer this time, for more flexible formatting, and because I'm confident this will finally solve the problem. ;)

Try this:

$destinationregex = '(?s)Destination: ([^\r\n]*).*?Start time:'

The (?s) means that wildcards can match newline characters. The grouping ([^\\r\\n]*) matches until the end of the line, and the .*? matches the line break. The following would work too:

$destinationregex = 'Destination: (.*?)\\r\\nStart time:'

In fact, since you really only want to match from after "Destination: " to the end of the line, you could just do this, which is the simplest (unless you specifically want to make sure that you only match if "Start time:" is the very next thing):

$destinationregex = 'Destination: (.*)'

If it still doesn't work, it may be because $message is being read as an array instead of a string. You can easily test that by adding the debugging line $message.GetType() immediately after setting $message. If it's an array, try setting $message this way (in addition to using one of the regular expressions above):

$message = $event.message | Out-String

In fact, doing it this way works in either case, but the | Out-String | Out-String is superfluous if it's already a string, though it doesn't hurt.

For clarity, here's the modified code block, as I think it will end up, depending on the answers to the questions above:

foreach ($event in $events)
{
  $message = $event.message | Out-String
  $destinationregex = 'Destination: (.*)'
  If ($message -match $destinationregex)
  {
    $destination = $matches[1]
  }
  else
  {
    $destination = "Unknown"
  }
  Write-Host $destination
}