We used this script to crawl the system logs and convert them to json, which was successful
However, we found that json is not able to appear characters such as line returns.
So, is there any way to prevent line feeds or carriage returns on the message field on the powershell, or to combine line breaks or carriage returns into one line
We tried using place to replace the n character with a space
We’ve also tried the -join approach
None of them are ideal
$event_system = foreach ($event_system in Get-WinEvent -LogName system) {
$props = @{
'ID' = $event_system.ID;
'Level' = switch ($event_system.Level){0{"LogAlways"}1{"Critical"}2{"Error"}3{"Warning"}4{"Informational"}5{"Verbose"}};
'ProviderName' = $event_system.ProviderName;
'UserId' = if($event_system.UserId -ne $null){((New-Object System.Security.Principal.SecurityIdentifier($event_system.UserId)).Translate( [System.Security.Principal.NTAccount])).Value}else{" "};
'Message' = $event_system.Message -replace("\r\n"," ");
'hostname' = [Environment]::MachineName
}
New-Object -TypeName PSObject -Property $props
}
$event_system | Select-Object hostname, ID, Level, UserId, ProviderName, Message | ConvertTo-Json