我正在尝试拆分我的子串的一部分(在'Event' =$_.Substring(23).Trim()
下面)并且似乎无法弄明白。我尝试过Trim()
,Split()
,TrimEnd()
和各种其他嵌套foreach
语句但效果不佳。
现在代码获取一个日志文件并解析出日期和事件。我想进一步解析事件,从“常规”开始,这将是事件的类型。
这是当前的日志文件片段。
2017-09-21 14:45:00.778 General Removed local reservations for command with future handle: 7129d084-8b68-4b3e-9df7-54832a4590f1 Display: False 2017-09-21 14:45:00.778 Debug Published update SetLightTowerState (id=7129d084-8b68-4b3e-9df7-54832a4590f1) [100.0 %] RanToCompletion - Complete (RanToCompletion) Display: False 2017-09-21 14:45:00.778 General Command: SetLightTowerState status: RanToCompletion (id=7129d084-8b68-4b3e-9df7-54832a4590f1) Display: False Source: Primary\Printer Light Tower
所有日志都存储在一个文件夹中,然后我将它们导出并导出到csv。
foreach ($file in Get-ChildItem $fileDirectory) {
(Get-Content $fileDirectory$file -Raw) -split '(?m)(?=^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})'
Where {$_} |
ForEach-Object {
[PSCustomObject]@{
'Date/Time' = " " + $_.Substring(0, 23)
'Event' = $_.Substring(23).Trim()
# Want to further split the string up here and make new Columns
# statement type', 'statement', 'display' 'source' etc...
}
} | Export-Csv C:\fileLocation\$file.csv -NoTypeInformation
}
目前的结果如下: