Regex: Filter string

Question

for other processes I want to split the following line into objects. The Line is from our Exchange Incomming SMTP Logfile.

2014-05-23T08:38:58.869Z,Exchangeserver\External Relay,08D1437A9AEFF27B,5,192.168.100.211:25,192.168.100.211:46964,<,MAIL FROM: <[email protected]>

Is it possible to do this with regular expressions?

Desired Output:

Time: 08:38:58
Connector: Exchangeserver\External Relay
ExchangeID:08D1437A9AEFF27B
MailFrom:[email protected]

I´m sorry, but regular expressions are to heavy for my brain.. :(

Thanks a lot!

AdamL · Accepted Answer · 2014-05-26 11:41:27Z

2

You only need regex for email addres. You can split columns with, well, -split :)

$arr = @("2014-05-23T08:38:58.869Z,Exchangeserver\External Relay,08D1437A9AEFF27B,5,192.168.100.211:25,192.168.100.211:46964,<,MAIL FROM: <[email protected]> " -split ",")

$ht = [ordered]@{}
$ht["Time"] = $arr[0]
$ht["Connector"] = $arr[1]
$ht["ExchangeID"] = $arr[2]
$ht["MailFrom"] = $($arr[7] -match "([^=@]+@[^>]+)" | Out-Null; $matches[1])

$ht

You can then format the results from hashtable to get your desired output.

edited May 26, 2014 at 11:41

answered May 23, 2014 at 12:20

AdamL

13.3k5 gold badges57 silver badges79 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Daniel4711 Over a year ago

Ok.. i will use -split in further tasks! But Exchange 2010 is not compatible with PowerShell V3, so that [ordered] is not available. Don´t know if it is necessary, but the second line (datetime) is not working on our 2008R2 Server. On Windows 8.0 it works, but the Output is: Name Value ---- ----- Time 12:00:00

AdamL Over a year ago

@Daniel4711 Someone edited my answer, I didn't cast Time. If you want to extract time, find appropriate formatting string, or just use regex. As of [ordered]: it's not necessary. Hash tables don't guarantee to preserver order of items, but it's not a problem here, you'll probably be referencing the values explicitly by key, anyway.

mjolinor · Accepted Answer · 2014-05-23 12:34:18Z

2

$line = 
'2014-05-23T08:38:58.869Z,Exchangeserver\External Relay,08D1437A9AEFF27B,5,192.168.100.211:25,192.168.100.211:46964,<,MAIL FROM: <[email protected]>'

$regex = '^[0-9-]+T([0-9:]+).+?,(.+?),(.+?),.+?MAIL FROM: <.*?(\w+@\w+?\.\w+)>'

$line | 
 New-PSObjectFromMatches -pattern $regex -Property $null,Time,Connector,ExchangeID,MailFrom |
 format-list


Time       : 08:38:58
Connector  : Exchangeserver\External Relay
ExchangeID : 08D1437A9AEFF27B
MailFrom   : [email protected]

You can get that New-PSObjectFromMatches function here:

http://gallery.technet.microsoft.com/scriptcenter/New-PSObjectFromMatches-87d8ce87

answered May 23, 2014 at 12:34

mjolinor

68.7k7 gold badges118 silver badges141 bronze badges

3 Comments

Frode F. Over a year ago

+1 Great function! One of those codeblocks you always recreate when you need them, but never remember to save. Finally got it saved :D

mjolinor Over a year ago

Thanks (try the -debug)!

Daniel4711 Over a year ago

Thanks for the Tip, but modifying the $Regex is hard stuff. -Split is not so powerful, but easy to use!

Collectives™ on Stack Overflow

Regex: Filter string

2 Answers 2

2 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related