解析自定義日志文件

Question

我有一個日志文件（* .log），我希望對其進行分析和查詢，如下所示：

Line 33043: 17/07/2016;13:26:45;GetMasterOrderNo;Master Order No is :  1117103907 for SoSupplierOrderNo, 1117103907
Line 33048: 17/07/2016;13:26:45;AddAutoPurchHdr;Could not save PurchHdr record - The supplier order number has already been used in Delivery Note No.1117103907 (Order No.1117103907), Supplier SupplierName(51)
Line 33049: 17/07/2016;13:26:45;ImportASN;ConvertASNFiles: Failed to import GRN1171_0000700384_1117103907.xml.  Could not save PurchHdr record - The supplier order number has already been used in Delivery Note No.1117103907 (Order No.1117103907), Supplier SupplierName(51)

我想做的是用標題拆分每一行，如下所示：

• 線，
• 日期，
• 時間，
• 類型，
• 描述

...這樣我就可以對此進行查詢。

最好的方法是什么？

Answer 1

您可以使用正則表達式來捕獲這些字段：

$content = Get-Content 'your_log_path' -raw
$regex = 'Line\s+(\d+):\s+([^;]+);([^;]+);([^;]+);(.+)'
[regex]::Matches($content, $regex) | ForEach-Object {
    [PsCustomObject]@{
        Line = $_.Groups[1].Value
        Date = $_.Groups[2].Value
        Time = $_.Groups[3].Value
        Type = $_.Groups[4].Value
        Description = $_.Groups[5].Value
    }
}

輸出：

Line        : 33043
Date        : 17/07/2016
Time        : 13:26:45
Type        : GetMasterOrderNo
Description : Master Order No is :  1117103907 for SoSupplierOrderNo, 1117103907

Line        : 33048
Date        : 17/07/2016
Time        : 13:26:45
Type        : AddAutoPurchHdr
Description : Could not save PurchHdr record - The supplier order number has already been used in Delivery Note No.1117103907 (Order No.1117103907), Supplier SupplierName(51)

Line        : 33049
Date        : 17/07/2016
Time        : 13:26:45
Type        : ImportASN
Description : ConvertASNFiles: Failed to import GRN1171_0000700384_1117103907.xml.  Could not save PurchHdr record - The supplier order number has already been used in Delivery Note 
              No.1117103907 (Order No.1117103907), Supplier SupplierName(51)

---

正則表達式：

Line\s+(\d+):\s+([^;]+);([^;]+);([^;]+);(.+)

Answer 2

對馬丁的很好回答有些修正。 [PSCustomObject]構造在Powershell v2主機上不起作用。

$content = Get-Content 'your_log_path' -raw
$regex = 'Line\s+(\d+):\s+([^;]+);([^;]+);([^;]+);(.+)'
[regex]::Matches($content, $regex) | ForEach-Object {
    $obj = New-Object PSObject
    $obj | Add-Member -MemberType NoteProperty -Name Line -Value $_.Groups[1].Value
    $obj | Add-Member -MemberType NoteProperty -Name Date -Value $_.Groups[2].Value
    $obj | Add-Member -MemberType NoteProperty -Name Time -Value $_.Groups[3].Value
    $obj | Add-Member -MemberType NoteProperty -Name Type -Value $_.Groups[4].Value
    $obj | Add-Member -MemberType NoteProperty -Name Description -Value $_.Groups[5].Value
    $obj
}

Answer 3

使用帶有名稱的Regex捕獲組為自定義對象創建哈希表鍵：

Get-Content log.txt | ForEach {
    $_ -match '^Line (?<Line>\d+): (?<Day>..)/(?<Month>..)/(?<Year>....);(?<Time>.*?);(?<Type>.*?);(?<Message>.*)$'

    # Cast date and line to useful types (optional)
    $Matches['Date'] = Get-Date ($Matches['Year']+'-'+$Matches['Month']+'-'+$Matches['Day']+' '+$Matches['Time'])
    $Matches['Line'] = [int]$Matches['Line']

    New-Object -Type PSCustomObject -Property $Matches
}