PowerShell - 使用命名捕获组的正则表达式需要帮助

Question

Good Evening,

I am trying to teach myself regex and running into an issue trying to figure this out. I have 3 days worth of logs that will look similar to below.

I am capturing the information into named capture groups and then adding in powershell to an array list.

Problems, I need to ignore everything between < > , I don't need it.

Then I need to look ahead and see if it is Added , Deleted or Updated , ignoring the Configuration part. Then return the match if it is one of those 3. Then skip BY USER and just grab the user name.

The final result should look like this from regex perspective:

Date    09 Dec 2020
Time    12:59:28
ErrorID VPSa0217I
PrintQ  PRINTQUEUE1
Action  UPDATED
User    op9p99

Logfile containing records like these:

09 Dec 2020 12:59:28 VPSa0217I <CREQ0009        > PRINTQUEUE1 ADDED BY USER op9p99
09 Dec 2020 13:00:22 VPSa0219I <CREQ0011        > PRINTQUEUE1 CONFIGURATION UPDATED BY USER op9p99
09 Dec 2020 14:20:59 VPSa0217I <CREQ0014        > PRINTQUEUE1 DELETED BY USER op9p99

Tried:

#$Regex1 = "(?<Date>\d{2}\s[ADFJMNOS][a-z]{2,8}\s[12][0-9]{3}\b)\s(?<Time>(?!\s)\d+:\d+:\d+).(?<ErrorID>[VPSa]{2,4}\d{4}[A-Z])(?<Junk>.<.*?>.*?\s)(?<PrintQ>\w+)(?<Action>.\bADDED|DELETED|UPDATED\b)(?<Junk2>\s\w+\s\w+\s)(?<User>\w+)"
    
#$Regex2 = "(?<Date>\d{2}\s[ADFJMNOS][a-z]{2,8}\s[12][0-9]{3}\b)(?<Time>\s+\d{1,2}:\d{2}:\d{2})\s(?<ErrorID>[VPSa]{2,4}\d{4}[A-Z])(?<Junk>.<.*?>.*?\s)(?<PrintQ>\w+)(?<Action>\s\bADDED|DELETED|UPDATED\b)(?<Junk2>\s\w+\s\w+\s)(?<User>\w+)"
    
$regex3 = "(?<Date>\d{2}\s[ADFJMNOS][a-z]{2,8}\s[12][0-9]{3}\b)(?<Time>\s+\d{1,2}:\d{2}:\d{2})\s(?<ErrorID>[VPSa]{2,4}\d{4}[A-Z])(?<Junk>.<.*?>.*?\s)(?<PrintQ>\w+).(?<Action>ADDED|DELETED|UPDATED\b)(?<Junk2>\s\w+\s\w+\s)(?<User>\w+)"

Works:

$Datereg = "(?<Date>\d{2}\s[ADFJMNOS][a-z]{2,8}\s[12][0-9]{3}\b)"
$TimeReg = "(?<Time>\s+\d{1,2}:\d{2}:\d{2})\s"
$ErrorIDReg = "(?<ErrorID>[VPSa]{2,4}\d{4}[A-Z])"
$Junk1Reg = "(?<Junk>.<.*?>.*?\s)"
$PrintQreg = "(?<PrintQ>\w+)"
$ActionReg = "(?<Action>\s\w+)"
$Junk2Reg = "(?<Junk2>\s\w+\s\w+)"
$UserReg = "(?<User>\s\w+\s)"

$regex = $Datereg + $TimeReg + $ErrorIDReg + $Junk1Reg + $PrintQreg + $ActionReg + $Junk2Reg + $UserReg

Thanks for the help.

Answer 1

Given that the tokens of interest are mostly space-separated tokens, I suggest a different approach, based primarily on -split , the string splitting operator :

Get-Content logfile.txt | ForEach-Object { 

  # Split the line into tokens by whitespace.
  $tokens = -split $_

  # Get the action value.
  # Use the 4th token *from the end* (-4) to account for the fact that
  # some lines have an extra word - 'CONFIGURATION' - inserted before the
  # action value.
  $action = $tokens[-4]
 
  if ($action -in 'UPDATED', 'DELETED', 'ADDED') {
    # Construct and output an object from the tokens.
    [pscustomobject] @{ 
      Date = $tokens[0..2] -join ' '
      Time = $tokens[3]
      ErrorId = $tokens[4]
      PrintQ = $tokens[7]
      Action = $action
      User = $tokens[-1] # user is always the last token
    }
  }

}

^{Note: PowerShell's operators are generally case- insensitive ; if you need case- sensitive matching, place a c before the operator name, such as -ceq and -cin .}

With your sample input, the above outputs:

Date    : 09 Dec 2020
Time    : 12:59:28
ErrorId : VPSa0217I
PrintQ  : PRINTQUEUE1
Action  : ADDED
User    : op9p99

Date    : 09 Dec 2020
Time    : 13:00:22
ErrorId : VPSa0219I
PrintQ  : PRINTQUEUE1
Action  : UPDATED
User    : op9p99

Date    : 09 Dec 2020
Time    : 14:20:59
ErrorId : VPSa0217I
PrintQ  : PRINTQUEUE1
Action  : DELETED
User    : op9p99

Answer 2

Try this set of regexes:

$log = @"
09 Dec 2020 12:59:28 VPSa0217I <CREQ0009        > PRINTQUEUE1 ADDED BY USER op9p99
09 Dec 2020 13:00:22 VPSa0219I <CREQ0011        > PRINTQUEUE1 CONFIGURATION UPDATED BY USER op9p99
09 Dec 2020 14:20:59 VPSa0217I <CREQ0014        > PRINTQUEUE1 DELETED BY USER op9p99
"@

$DateReg = "(?<Date>\d{2}\s[ADFJMNOS][a-z]{2,8}\s[12][0-9]{3}\b)"
$TimeReg = "(?<Time>\s+\d{1,2}:\d{2}:\d{2})\s"
$ErrorIDReg = "(?<ErrorID>[VPSa]{2,4}\d{4}[A-Z])\s"
$Junk1Reg = "(?<Junk><[^>]+>)\s"
$PrintQreg = "(?<PrintQ>\w+)\s(?!CONFIGURATION\s)"
$ActionReg = "(?<Action>\w+)\s"
$Junk2Reg = "(?<Junk2>\w+\s\w+)\s"
$UserReg = "(?<User>\w+)"

$regex = $Datereg + $TimeReg + $ErrorIDReg + $Junk1Reg + $PrintQreg + $ActionReg + $Junk2Reg + $UserReg

$log -split "`n" | Foreach-Object { if ($_ -match $regex) {"Matched line: $_"}}

Which outputs:

Matched line: 09 Dec 2020 12:59:28 VPSa0217I <CREQ0009        > PRINTQUEUE1 ADDED BY USER op9p99
Matched line: 09 Dec 2020 14:20:59 VPSa0217I <CREQ0014        > PRINTQUEUE1 DELETED BY USER op9p99

The primary tweak was to use a zero-width assertion called negative lookahead to make sure that after the PrintQ text there is not the text CONFIGURATION . I also tweaked your Junk1Reg to use <[^>]+> .