none
Powershell: Reading string without interpreting signs (RegEx) RRS feed

  • Question

  • Hello,

    I wan't to compare a part of a string to logfile entry. Problem is that the log contains signs lik * ? or ohter which poweshell is interpreting as regualr expressions and don't find the match. How can I read the log text without interpreting signs? I tried it with [Regex]::Escape() method but then the text is read with \ to escape the signs and match does also fail.

    Is there another possibility?

    $Msg = "<Name from Monitor Alert>" $Desc = "<Description from Monitor Alert>".substring(99,100) $Search = "User is not allowed access to page" IF ($Msg -match "Log File Alert: eGK KAMS")

    { IF ($Desc -match $Search) { $CreateTicket = 0 } } ELSE { $CreateTicket = 1 }


    

    Friday, May 27, 2016 11:51 AM

Answers

  • Sorry but I don't think any of us can decode what you are asking. 

    My best guess is this:

    $desc='Detected Entry: [12.05.16 16:01:45:344 CEST] 00000028 SystemOut O <2016-05-12 16:01:45,344> <ERROR> <ntainer : 2> <Der Request ist fehlgeschlagen. EventId: 160512160145KREWT*** | LogInstance: KAUFK;KKHVSDM;1.2.4-7;001 | LogReference: Ref1 | ComponentType: UFS | ErrorCode: 11101 | ErrorType: Technical | Severity: Fatal | ErrorText: F'

    $desc | Select-String  -Pattern 'User is not allowed access to page' -SimpleMatch


    \_(ツ)_/

    Friday, May 27, 2016 2:03 PM

All replies

  • Reverse this 

    $Msg -match "Log File Alert: eGK KAMS"

    to

    "Log File Alert: eGK KAMS" -match $Msg

    Friday, May 27, 2016 12:21 PM
  • PS C:\Users\swadmin> $Msg = "eGK KAMS"
    PS C:\Users\swadmin> $Msg -match "Log File Alert: eGK KAMS"
    False
    PS C:\Users\swadmin> "Log File Alert: eGK KAMS" -match $Msg
    True

    Friday, May 27, 2016 12:23 PM
  • Hello,

    thank you both for the reply. This part of the Script runs perfectly. Ist the other comparison:

    IF ($Desc -match $Search).

    For better understanding I will give you an example description:

    At this description I am searching for the string at $search. This Fails because of the formatting inside the description.

    Friday, May 27, 2016 12:30 PM
  • You have done a perfect job of supplying no useful I formation.

    What are you searching for and what are you trying to match?

    What is in $search?  What is in $desc?

    If $desc is multiline then you will have to take extra steps.


    \_(ツ)_/

    Friday, May 27, 2016 12:39 PM
  • Hello jrv,

    thanks for you friendly reply. If you have read my opening post there you find the $search string. The matches are given within the script part.  Whats your problem?

    The $desc is not multiline - at the variable ist one string. Unfortunately I cannot paste it into this Forum because the html is interpreting it too.

    Friday, May 27, 2016 12:42 PM
  • You first post makes no sense.

    How can $Msg -match "Log File Alert: eGK KAMS" match when $msg is "Name from Monitor Alert" and it is hard coded.  It will never match.

    This is the same:

     "Name from Monitor Alert" -match "Log File Alert: eGK KAMS"

    How could that ever  match anything. There is no regex pattern.  It is just plain text.

    What you are asking is vague and you have not supplied any useful example. Please supply an example of what you are asking about.


    \_(ツ)_/

    Friday, May 27, 2016 12:48 PM
  • Hi jrv,

    I think you have a good day today, isn't it. Or why are so unkind? (as a little tip "make no sense" could be better rewrite with "I don't understand...")

    The content at $msg and $desc is just a dummy . I use it in a dialog of a tool where this information were forwarded from parameters.

    The Problem is the formatting of the description as you can see in the screenshot. It contains different signs like * ? | < > and so one which the powershell is interpreting while reading the parameter. And the comparision with $search fails.


    Friday, May 27, 2016 12:56 PM
  • You need to match the other way around if that is your issue.

    The left side of "match" is text. The right side is a RegEx pattern. If you don't want to use template characters then the must be escaped. \? \( \)

    For each character that is a template token add a '\' in front of it to have it treated like a normal character.  My guess is that you shouldnot be using "match".  You need lo use absolute matching.

    $msg | Select-String -Pattern $desc -SimpleMatch


    \_(ツ)_/


    • Edited by jrv Friday, May 27, 2016 1:20 PM
    Friday, May 27, 2016 1:20 PM
  • Please read my post correctly. It is not the part with the $msg it's with the description.

    And the string there is given from a paramater so it's not the same and I cannot escape the signs. It's a log entry - what there will be written is not known. I used RegEx::Escape but then the match also fails.

    $Desc = "<PARA>".substring(99,100)

    $Search = "User is not allowed access to page"

    IF ($Desc -match $Search)

    { $CreateTicket = 0 }

    ELSE

    { $CreateTicket = 1 }

    Example string for description (PARA): 

    Detected Entry: [12.05.16 16:01:45:344 CEST] 00000028 SystemOut O <2016-05-12 16:01:45,344> <ERROR> <ntainer : 2> <Der Request ist fehlgeschlagen. EventId: 160512160145KREWT*** | LogInstance: KAUFK;KKHVSDM;1.2.4-7;001 | LogReference: Ref1 | ComponentType: UFS | ErrorCode: 11101 | ErrorType: Technical | Severity: Fatal | ErrorText: F



    Friday, May 27, 2016 1:31 PM
  • Sorry but I don't think any of us can decode what you are asking. 

    My best guess is this:

    $desc='Detected Entry: [12.05.16 16:01:45:344 CEST] 00000028 SystemOut O <2016-05-12 16:01:45,344> <ERROR> <ntainer : 2> <Der Request ist fehlgeschlagen. EventId: 160512160145KREWT*** | LogInstance: KAUFK;KKHVSDM;1.2.4-7;001 | LogReference: Ref1 | ComponentType: UFS | ErrorCode: 11101 | ErrorType: Technical | Severity: Fatal | ErrorText: F'

    $desc | Select-String  -Pattern 'User is not allowed access to page' -SimpleMatch


    \_(ツ)_/

    Friday, May 27, 2016 2:03 PM