[Solved] Extract data from a log that contains certain pattern

by


[replaced code using not-really-there asterisks in sample data.]

[powershell v5.1]
this will match any line that contains “login” and then extract the requested info using basic string operators. i tried to use regex, but got bogged down in the pattern matching. [blush] regex would almost certainly be faster, but this is easier for me to understand. 

# fake reading in a text file
#    in real life, use Get-Content
$InStuff = @'
192.168.100.1 - - [13/Dec/2018:15:11:52 -0600] "GET/onabc/soitc/BackChannel/?param=369%2FGetTableEntryList%2F7%2Fonabc-s31%2FHPD%3AIncident%20Management%20Console27%2FDefault%20User%20View%20(Manager)9%2F3020872007%2Resolved%22%20AND%20((%27Assignee%20Login%20ID%27%20%3D%20%22Allen%22)Token=FEIH-MTJQ-H9PR-LQDY-WIEA-ZULM-45FU-P1FK HTTP/1.1"
100.100.100.100 - - [06/Nov/2018:10:10:10 -0666] "nothing that contains the trigger word"
'@ -split [environment]::NewLine

$Results = foreach ($IS_Item in $InStuff)
    {
    if ($IS_Item -match 'login')
        {
        # build a custom object with the desired items
        #    the PSCO makes export to a CSV file very, very easy [*grin*] 
        # the split pattern is _very fragile_ and will break if the pattern is not consistent
        #    a regex pattern would likely be both faster and less fragile, but i can't figure one out
        [PSCustomObject]@{
            IP = $IS_Item.Split(' ')[0].TrimStart('**')
            Date = $IS_Item.Split('[}')[1].Split(':')[0]
            # corrected for not-really-there asterisks
            #LoginName = $IS_Item.Split('*')[-3]
            LoginName = (($IS_Item.Split(')')[-2] -replace '%\w{2}') -csplit 'ID')[1]
            }
        }
    }

# show on screen
$Results

# save to a CSV file
$Results |
    Export-Csv -LiteralPath "$env:TEMP\Henry_Chinasky_-_LogExtract.CSV" -NoTypeInformation

on screen output … 

IP            Date        LoginName
--            ----        ---------
192.168.100.1 13/Dec/2018 Allen

csv file content … 

"IP","Date","LoginName"
"192.168.100.1","13/Dec/2018","Allen"

0

solved Extract data from a log that contains certain pattern