解析日志文件 - 提取具有多个目标的行并进一步解析结果

Question

我有一个关于在 powershell 3.0 中解析日志文件的问题。非常感谢帮助

日志文件示例：

.Processing begin...
     -Sending file \CL2BATCH1\CFGP\PDF\templates\T_Test_Printer_Page.pdf to test the printer...
     [05:15:06 AM] Begin printing file [\CL2BATCH1\CFGP\PDF\templates\T_Test_Printer_Page.pdf]. Number of pages:1
     [05:15:07 AM] Print completed.

     [5:15:08 AM] Merging PDF files to master PDF file:\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\P_00292300-00_700700-0000_1_AMC_20200325051507.PDF
      [5:15:08 AM] Merged file:\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\MC_SCHLIST_000.PDF
      [5:15:08 AM] Merged file:\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\MC_4729028.PDF
     [05:15:08 AM] Begin printing file [\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\P_00292300-00_700700-0000_1_AMC_20200325051507.PDF]. Number of pages:2
     [05:15:09 AM] Print completed.
    -----------------------------
       -Number of Accounts selected for this run:1
       -Number of Account successfully printed  :1
       -Number of Account failed to be printed  :0

   ----------------------------------
   Generating In-House School Report: MCPrintReport_700700-0000_1_20200325051507.PDF
     [5:15:10 AM] Merging PDF files to master PDF file:\SERVER1\CUSTOMERNAME\PDF\Alt_Man_Cert\MCPrintReport_700700-0000_1_20200325051507.PDF
     [05:15:10 AM] Begin printing file [\SERVER2\CUSTOMERNAME\PDF\Alt_Man_Cert\MCPrintReport_700700-0000_1_20200325051507.PDF]. Number of pages:1
     [05:15:11 AM] Print completed.

我想提取包含以下条件的行：

'开始打印文件' AND
'Alt_Man_Cert'

我当前的代码查看一组日志文件并正确提取整行。

$root = "c:\psscripts\mcprintcopy"
$files = Get-ChildItem -Filter MCPrint_*.log -Path $root


foreach($file in $files)
{

    if($file.LastWriteTime.ToShortDateString() -gt (get-date).AddDays(-.5))
    {

        $InStuff = Get-Content -LiteralPath $root$file
        Write-Host 'Analyzing File: '$file
        $TargetOne = 'Begin printing file'
        $TargetTwo = @(
            'Alt_Man_Cert'
            )
        # this pipeline version otta work with ps3
        $T2_Regex = ($TargetTwo |
            ForEach-Object {
            [regex]::Escape($_)
                }) -join '|'


        $InStuff |
            Where-Object {
                $_ -match $TargetOne -and
                $_ -match $T2_Regex
                }


        $r = [regex] "\[([^\[]*)\]"
        $match = $r.match($InStuff)
        $text = $match.groups[1].value


    }
}

问题是我实际上只想要括号之间的内容，因为我需要目录路径才能将这些文件复制到另一个目的地。

[\CL2BATCH1\CFGP\PDF\Alt_Man_Cert\P_00292300-00_700700-0000_1_AMC_20200325051507.PDF] 和 [\CL2BATCH1\CFGP\PDF\Alt_Man_Cert\MCPrintReport_700700-0000_1_20200325051507.PDF]

Answer 1

合并模式并使用捕获组（就像您的 $r）和自动 $matches 变量：

$InStuff = Get-Content -LiteralPath $root$file

$filePaths = $InStuff |ForEach-Object {
  if($_ -match 'Begin printing file \[([^\]]*Alt_Man_Cert[^\]]*)\]'){
    $matches[1]
  }
}

$filePaths 将包含文件路径（减去括号）

解析日志文件 - 提取具有多个目标的行并进一步解析结果

Parsing Log file - Extracting lines with multiple targets and further parsing results

powershell

powershell-3.0