Powershell RegEx: How can I match lines with two matching strings?

Question

I am trying to pull certain pieces of data from a text log file and save that data to an output file. The data in the text file looks like this:

2014-08-23 19:05:09 <nonmatching line>
2014-08-23 19:05:09 MATCH_STRING <stuff_I_don't_want> @description='12345 queue1 1 2 3' <more_stuff_I_don't_want_to_EOL>
2014-08-23 19:05:09 <nonmatching line>
2014-08-23 19:05:09 <nonmatching line>
2014-08-23 19:05:09 MATCH_STRING <stuff_I_don't_want> @description='12345 queue1 4 5 6' <more_stuff_I_don't_want_to_EOL>

I want to create an out put file that looks like this:

2014-08-23 19:05:09 12345 queue1 1 2 3
2014-08-23 19:05:09 12345 queue1 4 5 6

I have two RegEx expressions for the 2 necessary matches and when they are used seperately, they both work, as below:

(^.*?)(?=\b\tMATCH_STRING\b)

returns

2014-08-23 19:05:09
2014-08-23 19:05:09

and

(?<=@description\=')(?:(?!').)*

returns

12345 queue1 1 2 3
12345 queue1 4 5 6

The question is: How do I put them together so that they match both date at the beginning of the line and the quoted string in the line?

Bonus question: Is there more efficient RegEx for what I am trying to do?

Thanks

Answer 1

(\d+-\d+-\d+\s*\d+:\d+:\d+).*?(?=@description).*?=.(\d+)\s*(.*?[\d\s]+)

This regex gives all the groups you want.

See Demo.

http://regex101.com/r/lK9iD2/6

Answer 2

Another solution:

$matchstring = "MATCH_STRING"
$pattern = "(.*?)(?:\s*?$([regex]::Escape($matchstring)).*?description=')(.*?)'.*"

@"
2014-08-23 19:05:09 <nonmatching line>
2014-08-23 19:05:09 MATCH_STRING <stuff_I_don't_want> @description='12345 queue1 1 2 3' <more_stuff_I_don't_want_to_EOL>
2014-08-23 19:05:09 <nonmatching line>
2014-08-23 19:05:09 <nonmatching line>
2014-08-23 19:05:09MATCH_STRING <stuff_I_don't_want> @description='12345 queue1 4 5 6' <more_stuff_I_don't_want_to_EOL
"@ -split [environment]::newline |
Where-Object { $_ -match $pattern } |
ForEach-Object { $_ -replace $pattern, '$1 $2' }

2014-08-23 19:05:09 12345 queue1 1 2 3
2014-08-23 19:05:09 12345 queue1 4 5 6

Answer 3

You can use a regex like this:

^([\d-:\s]{2,}).*?(?<==)'(\d+)(.+?)'

Working demo

MATCH 1
1.  [39-59] `2014-08-23 19:05:09 `
2.  [107-112]   `12345`
3.  [112-125]   ` queue1 1 2 3`
MATCH 2
1.  [238-258]   `2014-08-23 19:05:09 `
2.  [306-311]   `12345`
3.  [311-324]   ` queue1 4 5 6`