0
votes

I am trying to write a code to parse a logfile within a specific date range, logfile content is below:

For eg: extracting the date (11/28 07:08:46) and parsing it.

[C79C] ComputerName:BETHGARWICK UserID:A0006 Beth Garwick Station 9  LanId: | (11/28 07:08:46) | Client is disconnected from agent.
[C79C] ComputerName:BETHGARWICK UserID: Logged out Station 0 LanId: | (11/28 07:08:51) | Client is connected to agent.

[EB7C] ComputerName:APT UserID:A0005 Kelley Zajac Station 4  LanId: | (11/28 07:12:08) | Client is disconnected from agent.
[EB7C] ComputerName:APT UserID:A0005 Kelley Zajac Station 4  LanId: | (11/28 07:12:13) | Client is connected to agent.

[EC44] ComputerName:KCUTSHALL-PC UserID:GO kcutshall Station 9900  LanId: | (11/28 07:55:08 - 11/28 07:55:18) | Average limit (300) exceeded while pinging www.google.com [74.125.224.82] 3 times
[EC44] ComputerName:KCUTSHALL-PC UserID:GO kcutshall Station 9900  LanId: | (11/28 07:55:23) | Average limit (300) exceeded while pinging www.google.com [www.google.com]
[EC44] ComputerName:KCUTSHALL-PC UserID:GO kcutshall Station 9900  LanId: | (11/28 07:55:29 - 11/28 07:55:49) | Average limit (300) exceeded while pinging www.google.com [74.125.224.50] 5x

[EC44] ComputerName:KCUTSHALL-PC UserID:GO kcutshall Station 9900  LanId: | (11/28 07:55:54 - 11/28 07:56:45) | Average limit (300) exceeded while pinging www.google.com [74.125.224.50] 11 times
[EC44] ComputerName:KCUTSHALL-PC UserID:GO kcutshall Station 9900  LanId: | (11/28 07:56:50) | Average limit (300) exceeded while pinging www.google.com [www.google.com]

Tried .net functions parseexact(), parse() but did not work.

$patter = 'mm/dd'
$culture = [Globalization.CultureInfo]::InvariantCulture

$logfiles = Get-Content -Path "C:\Users\ABC\Desktop\Temp\HTTPS\QoS_logs\test.logs"

$logfiles | foreach {

$dateasText = $_.ToString().Split("|")[1].Replace("(","").Replace(")","").Trim()

$date = [DateTime]::ParseExact($dateasText,$pattern,$null)

Exeption calling "ParseExact" with "3" argument(s): "String was not recognized as a valid DateTime." At "C:\Users\ABC\Desktop\Temp\HTTPS\QoS_logs\test.logs:23 char:1 + $date = [DateTime]::ParseExact($dateasText,$pattern,$null) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : FormatException

1
You haven't even told us what the content of $pattern is, how can we possibly help?DavidG
@PanagiotisKanavos I just tried in C#, DateTime.ParseExact("09/06", "MM/dd", null) results in the 6th of September 2019Bill Tür
Untested: aren't you missing an n here: $patter = 'mm/dd'?Bill Tür
@ThomasSchremser oops, I had a typo when I tried that pattern: "MM//dd".Panagiotis Kanavos
Your first code line should read $pattern = 'MM/dd' the n of pattern is missing and Month is upper case MM, the lower case mm is minutes. Aside from this your line extracting text fails on empty lines. Use a better RegEx to grep the date.user6811411

1 Answers

0
votes

Use $pattern as a RegEx to grep the date in a capture group dt

## Q:\Test\2019\09\06\SO_57819852.ps1
$pattern = ' LanId: \| \((?<dt>[01][0-9]/[0-3][0-9] [0-2][0-9]:[0-5][0-9]:[0-5][0-9])'

$logfile = "C:\Users\ABC\Desktop\Temp\HTTPS\QoS_logs\test.logs" # ".\test.logs"  # 

foreach($Line in Get-Content $logfile) {
    if ($Line -match $pattern){
        $date = [DateTime]::ParseExact($Matches.dt,'MM/dd HH:mm:ss',$null)
        $date
    }
}

Sample output in my German locale:

Donnerstag, 28. November 2019 07:08:46
Donnerstag, 28. November 2019 07:08:51
Donnerstag, 28. November 2019 07:12:08
Donnerstag, 28. November 2019 07:12:13
Donnerstag, 28. November 2019 07:55:08
Donnerstag, 28. November 2019 07:55:23
Donnerstag, 28. November 2019 07:55:29
Donnerstag, 28. November 2019 07:55:54
Donnerstag, 28. November 2019 07:56:50