Question

我有一个关于在Powershell 3.0中对日志文件进行某些解析的问题。非常感谢帮助

日志文件示例：

.Processing begin...
     -Sending file \\CL2BATCH1\CFGP\PDF\templates\T_Test_Printer_Page.pdf to test the printer...
     [05:15:06 AM] Begin printing file [\\CL2BATCH1\CFGP\PDF\templates\T_Test_Printer_Page.pdf]. Number of pages:1
     [05:15:07 AM] Print completed.

     [5:15:08 AM] Merging PDF files to master PDF file:\\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\P_00292300-00_700700-0000_1_AMC_20200325051507.PDF
      [5:15:08 AM] Merged file:\\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\MC_SCHLIST_000.PDF
      [5:15:08 AM] Merged file:\\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\MC_4729028.PDF
     [05:15:08 AM] Begin printing file [\\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\P_00292300-00_700700-0000_1_AMC_20200325051507.PDF]. Number of pages:2
     [05:15:09 AM] Print completed.
    -----------------------------
       -Number of Accounts selected for this run:1
       -Number of Account successfully printed  :1
       -Number of Account failed to be printed  :0

   ----------------------------------
   Generating In-House School Report: MCPrintReport_700700-0000_1_20200325051507.PDF
     [5:15:10 AM] Merging PDF files to master PDF file:\\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\MCPrintReport_700700-0000_1_20200325051507.PDF
     [05:15:10 AM] Begin printing file [\\SERVER2\CUSTOMERNAME\PDF\Alt_Man_Cert\MCPrintReport_700700-0000_1_20200325051507.PDF]. Number of pages:1
     [05:15:11 AM] Print completed.

我想提取包含以下条件的行：

'开始打印文件'AND
' Alt_Man_Cert '

我当前的代码遍历一组日志文件并正确提取整行。

$root = "c:\psscripts\mcprintcopy"
$files = Get-ChildItem -Filter MCPrint_*.log -Path $root


foreach($file in $files)
{

    if($file.LastWriteTime.ToShortDateString() -gt (get-date).AddDays(-.5))
    {

        $InStuff = Get-Content -LiteralPath $root\$file
        Write-Host 'Analyzing File: '$file
        $TargetOne = 'Begin printing file'
        $TargetTwo = @(
            'Alt_Man_Cert'
            )
        # this pipeline version otta work with ps3
        $T2_Regex = ($TargetTwo |
            ForEach-Object {
            [regex]::Escape($_)
                }) -join '|'


        $InStuff |
            Where-Object {
                $_ -match $TargetOne -and
                $_ -match $T2_Regex
                }


        $r = [regex] "\[([^\[]*)\]"
        $match = $r.match($InStuff)
        $text = $match.groups[1].value


    }
}

问题是我实际上只想要括号之间的内容，因为我需要目录路径将这些文件复制到另一个目标。

[\ CL2BATCH1 \ CFGP \ PDF \ Alt_Man_Cert \ P_00292300-00_700700-0000_1_AMC_20200325051507.PDF] 和 [\ CL2BATCH1 \ CFGP \ PDF \ Alt_Man_Cert \ MCPrintReport_700700-0000_1_20200325051507.PDF]

Answer 1

组合模式并为此使用捕获组（就像您的$r）和自动$matches变量一样

$InStuff = Get-Content -LiteralPath $root\$file

$filePaths = $InStuff |ForEach-Object {
  if($_ -match 'Begin printing file \[([^\]]*Alt_Man_Cert[^\]]*)\]'){
    $matches[1]
  }
}

$filePaths将包含文件路径（减去括号）

解析日志文件-提取具有多个目标的行并进一步解析结果

1 个答案: