locked
How to evaluate array element (CSV line) once with multiple regex patterns? RRS feed

  • Question

  • We have a logging application which produces well formatted output for systems known to it (CSV); otherwise it provides a long string of data into a generic "message" field in the CSV.

    I have 6 regular expression patterns which pulls the specific data I want out of generic message field to put into my custom formatted CSV.  

    $REGEX1 = 'pattern1'

    $REGEX2 = 'pattern2'

    $DATA | % {

    $_.message -match $REGEX1
    $_.message -match $REGEX2
    ..
    }

    I'm evaluating each CSV line 6 times- is there a more efficient way to do this?

     
    Wednesday, February 14, 2018 2:21 PM

All replies

  • You can combine regex patterns with "|".

    'pattern1|pattern2|pattern3'

    Wednesday, February 14, 2018 2:47 PM
  • If these are event log messages then all values in the message are available as parameters in the "Properties" collection on the event.

    There is never a need to parse the message text.


    \_(ツ)_/

    Wednesday, February 14, 2018 7:16 PM