# Log Parse Script **URL:** \ **Category:** PowerShell Help\ **Created:** [March 2, 2017, 1:17am UTC](https://forums.powershell.org/t/log-parse-script/8164 "2017-03-02T01:17:21Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![paultath81](https://avatars.discourse-cdn.com/v4/letter/p/9fc348/32.png) [@paultath81](https://forums.powershell.org/u/paultath81)\ **Post date:** [March 2, 2017, 1:17am UTC](https://forums.powershell.org/t/log-parse-script/8164/1 "2017-03-02T01:17:21Z")
I have an example txt file with the below contents which I would like to ONLY extract it’s substring. When I use the below command it’s grabbing the entire line. #Log File location. $path = “C:\log.log” #Search through log for matching string. Get-Content $path | Select-String -Pattern “size”,“company”,“customerid” ====================================== 01-01-2012 01:13:36 Blah blah : blah CustomerId:1234 downloaded Blah Size:5432 bytes Carrier:Company-A 01-01-2012 01:13:45 Blah blah : blah CustomerId:41444 downloaded Blah Size:38655 bytes Carrier:Company-S 01-01-2012 01:13:47 Blah blah : blah CustomerId:12334 downloaded Blah Size:25632 bytes Carrier:Company-A 01-01-2012 01:13:50 Blah blah : blah CustomerId:41444 downloaded Blah Size:7213 bytes Carrier:Company-S 01-01-2012 01:13:58 Blah blah : blah CustomerId:553155 downloaded Blah Size:70100 bytes Carrier:Company-V ---
**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\ **Post date:** [March 2, 2017, 3:23am UTC](https://forums.powershell.org/t/log-parse-script/8164/2 "2017-03-02T03:23:14Z")
Are the log entries really 2 lines each? What is the expected result you want? Could you give an example with one line? If you post code or log file content you should use the code tags as explained above the post edit tool. ---
**Author:** ![random-commandline](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@random-commandline](https://forums.powershell.org/u/random-commandline)\ **Post date:** [March 2, 2017, 10:08am UTC](https://forums.powershell.org/t/log-parse-script/8164/3 "2017-03-02T10:08:25Z")
If each line starts with a date, this should work. ``` $file = Get-ChildItem 'C:\log.log' $myobj = switch -Regex -File $file { 'CustomerId:(.*?) .*size:(.*?) .*Carrier:(.*)$' {[PSCustomObject]@{ID=$Matches[1];Size=$Matches[2];Company=$Matches[3]}} } $group = $myobj | Group-Object -Property ID foreach ($g in $group){ [PSCustomObject]@{ ID = $g.Name TotalSize = ($g.group.size | Measure-Object -Sum).Sum Company = $g.group.Company | select -First 1 } } # Results # ID TotalSize Company # 1234 5432 Company-A # 41444 45868 Company-S # 12334 25632 Company-A # 553155 70100 Company-V ``` ---
**Author:** ![sam-boutros](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/sam-boutros/32/5_2.png) [@sam-boutros](https://forums.powershell.org/u/sam-boutros)\ **Post date:** [March 2, 2017, 11:36am UTC](https://forums.powershell.org/t/log-parse-script/8164/4 "2017-03-02T11:36:12Z")
try: ``` #requires -Version 4 $LogData = Get-Content .\log.log $Output = @() foreach ($Line in $LogData) { if ($Line -match 'CustomerId') { $NewRecord = $true $CustomerID = $Line.Substring($Line.LastIndexOf(':')+1,$Line.Length-$Line.LastIndexOf(':')-1).Split(' ')[0] } if ($Line -match 'Size') { if ($NewRecord) { $Props = [ordered]@{ CustomerId = $CustomerID Company = $Line.Substring($Line.LastIndexOf(':')+1,$Line.Length-$Line.LastIndexOf(':')-1).Split(' ')[0] Size = $Line.Substring($Line.IndexOf(':')+1,$Line.Length-$Line.IndexOf(':')-1).Split(' ')[0] } $Output += New-Object -TypeName PSObject -Property $Props $NewRecord = $false } # else this is an orphan, disregard } } $Output | sort CustomerId | FT -a ``` You should get output like: ``` CustomerId Company Size ---------- ------- ---- 12334 Company-A 25632 1234 Company-A 5432 41444 Company-S 38655 41444 Company-S 7213 553155 Company-V 70100 ``` ---
**Author:** ![paultath81](https://avatars.discourse-cdn.com/v4/letter/p/9fc348/32.png) [@paultath81](https://forums.powershell.org/u/paultath81)\ **Post date:** [March 2, 2017, 11:51am UTC](https://forums.powershell.org/t/log-parse-script/8164/5 "2017-03-02T11:51:07Z")
Thanks all! How would I total the size of each unique customer? ---
**Author:** ![sam-boutros](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/sam-boutros/32/5_2.png) [@sam-boutros](https://forums.powershell.org/u/sam-boutros)\ **Post date:** [March 2, 2017, 1:01pm UTC](https://forums.powershell.org/t/log-parse-script/8164/6 "2017-03-02T13:01:35Z")
try: ``` $Groups = $Output | group -Property CustomerID | Sort Count -Descending $Tally = @() foreach ($Item in $Groups) { $Props = [ordered]@{ CustomerId = $Item.Group.CustomerID | select -First 1 Company = $Item.Group.Company | select -First 1 TotalSize = $($Sum = 0; $Item.Group.Size | % { $Sum += $_ }; $Sum) } $Tally += New-Object -TypeName PSObject -Property $Props } $Tally | sort CustomerId | FT -a ``` (This depends on $Output from above…) Example output: ``` CustomerId Company TotalSize ---------- ------- --------- 12334 Company-A 31064 41444 Company-S 45868 553155 Company-V 70100 ``` ---
**Author:** ![random-commandline](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@random-commandline](https://forums.powershell.org/u/random-commandline)\ **Post date:** [March 2, 2017, 1:29pm UTC](https://forums.powershell.org/t/log-parse-script/8164/7 "2017-03-02T13:29:28Z")
I edited my previous post to include total size for each customerid. ---
**Author:** ![paultath81](https://avatars.discourse-cdn.com/v4/letter/p/9fc348/32.png) [@paultath81](https://forums.powershell.org/u/paultath81)\ **Post date:** [March 2, 2017, 2:39pm UTC](https://forums.powershell.org/t/log-parse-script/8164/8 "2017-03-02T14:39:31Z")
Thanks guys for the help. ---
**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\ **Post date:** [May 16, 2024, 8:39pm UTC](https://forums.powershell.org/t/log-parse-script/8164/9 "2024-05-16T20:39:28Z")