CODEWITHSUNDEEP
powershell
bgrif
bgrif

Reputation: 263

get specific content out a select string that sees multiple lines

I am running a select string to find when an error occurs in one of my logs. when i run the command i am pulling 3 lines before and 0 lines after.

when running the command i am getting back results but i cannot figure out how to capture specific parts of the results so i can set this up to email me with just the specific content i need from it.

the select string i am using is:

Select-String -Path \\testserver\d$\_Prod\product\Logs\App\product.log -Pattern 'Unable to authenticate/authorize user:' -Context 3,0

the results i am getting back after running this command is: 

  \\testserver\d$\_Prod\product\Logs\App\product.log:24443:26 Jul 2019 09:57:52,238 INFO (com.product.vs.ws.policy.AuthenticationHandler:validate:55) - Done authenticating/authorizing user: adam
  \\testserver\d$\_Prod\product\Logs\App\product.log:24444:26 Jul 2019 09:57:52,238 INFO (com.product.vs.ws.impl.ImportExportServiceImpl:importEmployeesWithAckByDS:529) - Importing multiple employees. Company/user: 1111222113
  \\testserver\d$\_Prod\product\Logs\App\product.log:24445:26 Jul 2019 09:57:52,316ERROR (com.product.vs.ws.impl.ImportExportServiceImpl:importEmployeesWithAckByDS:538) - Unable to process request!
> \\testserver\d$\_Prod\product\Logs\App\product.log:24446:com.bsi.ef.exception.AuthenticationException: Unable to authenticate/authorize user: adam

the parts that I need are the pattern with the name and the the company/user with the value after it.

I am unsure on how to get the information for the pattern and the company/name. I need both of the information only when the pattern matches. If i remove the -Context 3,0 it only gives me the pattern match and i need the company/name as well.

info from log 

26 Jul 2019 09:57:38,037 INFO (com.product.vs.ws.policy.AuthenticationHandler:validate:42) - Authenticating/authorizing user: adam
26 Jul 2019 09:57:38,037 INFO (com.product.vs.ws.policy.AuthenticationHandler:validate:55) - Done authenticating/authorizing user: adam
26 Jul 2019 09:57:38,037 INFO (com.product.vs.ws.impl.ImportExportServiceImpl:importEmployeesWithAckByDS:529) - Importing multiple employees. Company/user: 1111222113
26 Jul 2019 09:57:38,115ERROR (com.product.vs.ws.impl.ImportExportServiceImpl:importEmployeesWithAckByDS:538) - Unable to process request!
com.product.vs.exception.AuthenticationException: Unable to authenticate/authorize user: adam
    at com.product.vs.ws.impl.ImportExportServiceImpl.importEmployeesWithAckByDS(ImportExportServiceImpl.java:531)`

^ Original post

I have found out today that I need it to return results for Unable to authenticate/authorize user even if the Company/user does not show in the logs.

info from today's log

29 Jul 2019 10:25:25,181 INFO (com.product.vs.svc.ImpStgReqProcessCreator:run:68) - No records available in Staging Table for pick up...
29 Jul 2019 10:27:25,197 INFO (com.product.vs.svc.ImpStgReqProcessCreator:run:68) - No records available in Staging Table for pick up...
29 Jul 2019 10:28:30,725 INFO (com.product.vs.policy.AuthenticationHandler:validate:42) - Authenticating/authorizing user: Johnny
29 Jul 2019 10:28:30,725ERROR (com.product.vs.ws.policy.AuthenticationHandler:validate:50) - Unable to authenticate/authorize user: Johnny`

Upvotes: 0

Views: 401

Answers (1)

user6811411
user6811411

Reputation:

  • The Select-String output you posted is just the default representation of the returned structured MatchInfo object.
  • As the pattern is RegEx based, you could either use a more complex multiline RegEx
    -or-
    evaluate the .context/.precontext property separately.
$Result = Select-String .\product.log -Pattern 'Unable to authenticate/authorize user:' -Context 3,0

$Result | Get-Member

$Result.Context | Get-Member

view output of above commands, and then try

$Result = Select-String .\product.log -Pattern 'Unable to authenticate/authorize user: (.*)' -Context 3,0
$Result.Matches.Groups[1].Value
if (($Result.Context.PreContext -join '') -match 'Company/user: (\d+)'){$Matches[1]}

to get the content of the added (capture group) for the trailing name and the $Matches object for the trailing company number.

Output with above sample data:

adam
111122211326

Upvotes: 1

Related Questions