Need to extract lines from a log file

garyfthomas · 2019-01-31T16:05:09.000Z

OK, so let’s be clear. I don’t really have a programming background but I’ve muddled my way through creating a few PowerShell scripts to get some jobs done. Now I’ve got a much more complex thing that I’ve been asked to do, and I’m not sure how to go about it.

What I need to do is search a log file (it’s a simple text file) for the word error and then pull about 5 lines previous to that error and put them in an email.

If outputting to a new text file and sending that file as an attachment is easier that’s perfectly acceptable, I just need to be notified if a specific process outputs an error in the log file.

Is this possible?

Neally · 2019-01-31T16:10:03.000Z

Sure it’s possible, but let’s be clear, we’re happy to help, but not a script writing service

Post what you’ve tried and where you’re stuck and we’ll help

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

Evan7191 · 2019-01-31T16:13:02.000Z

You can use Select-String -Pattern error -Context 5 to find the word Error and capture the the next five lines.

tulioarends · 2019-01-31T17:19:25.000Z

Black magic (otherwise known as regexps to the rescue! Try

$pattern='(?<prevLines>(?:^.*?$){5})(?<errorLine>^.*(?i)error(?-i).*$)'

as a regular expression in PowerShell.

This is fairly complex so don’t be daunted if you don’t get it at the beginning. Here is a breakdown of the pattern:

garyfthomas · 2019-01-31T19:06:19.000Z

Tulio, you may have gone way past me.

Here’s what I have that I think will work, it’s basically just pulled from a couple of different commands:

$date = Get-Date -Format "M-d-yyyy"

Get-ChildItem "\\path" -Filter "ScriptDebugLog $date.log" | Select-String -Pattern 'ERROR' -Context 3 | Set-Content "\\path\temp\output_file.txt"

Send-MailMessage -From "server <server@company.com>" -To "user <user@company.com>" -Subject "Error" -Body "Error occurred on $date" -Attachments "\\path\temp\output_file.txt" -dno onSuccess, onFailure -SmtpServer "smtpserver"

Obviously I may need to clean it up, but I think this will work and only search the file that was created today. My only concern is that actual filenames don’t have leading zeros one either single digit months or dates and I’m not sure how my get-date command will return a date like tomorrow, 2-1-2019.

tulioarends · 2019-02-01T12:12:36.000Z

Select-String is a cleaner, more readable way of creating and using the pattern I gave you, it uses the .NET regular expression engine under the hood. It is also not as flexible.

It should do the job you want.