PowerShell Tail file but ignore lines matching pattern

Question

A Solaris Admin trying to work with log files in a Windows world. I am trying to tail a Log File, but there are 6 repeating lines that I'd like to ignore. I've been able to select the lines with:

Get-Content alert.log -Tail 300 -Wait | Select-String -Pattern "WARNING: too" -Context 1,6

But I'm trying to ignore these 'Context' lines. I have tried adding -NotMatch to the end, but it ends up printing the lines I'm trying to ignore.

In Solaris I would do:

tail -300f alert.log | egrep -B1 -A6 -v "WARNING: too"

I'm trying to find a PowerShell equivalent, without success. I have had success with ignoring the one matching line:

Get-Content alert.log -Tail 300 | ?{$_ -notmatch 'WARNING: too'}

But how do I extend this to the line above and 6 below? The types of lines I want to ignore are:

2020-05-20T15:32:13.870875+10:00
WARNING: too many parse errors
PARSE ERROR:
2020-05-20T15:32:13.886503+10:00
begin ORACLE PL/SQL; end;
Additional information: hd=00007FF6E4A08E68
...Current username=FRED
...Application: work3wp.exe

Action: I've been able create this statement:

Get-Content .\alert_prod.log -Tail 300 -Wait | ?{$_ -notmatch "WARNING: too|begin FRED|Additional information|Current username|Application: work3wp.exe|PARSE ERROR:" }

But the date/time stamp at the start of the error appears each time. I want the date/time stamp of other errors.

Is there no way to capture the context lines by any pattern? — stackprotector, May 20 '20 at 05:14
Does [`Select-String -context`](https://stackoverflow.com/a/42694311/503046) work as intended? — vonPryz, May 20 '20 at 05:29
The types of lines I want to ignore are: 2020-05-20T15:32:13.870875+10:00 WARNING: too many parse errors PARSE ERROR: 2020-05-20T15:32:13.886503+10:00 begin ORACLE PL/SQL; end; Additional information: hd=00007FF6E4A08E68 ...Current username=FRED ...Application: work3wp.exe Action: I've been able to: Get-Content .\alert_prod.log -Tail 300 -Wait | ?{$_ -notmatch "WARNING: too|begin FRED|Additional information|Current username|Application: work3wp.exe|PARSE ERROR:" } But the date/time stamp at the start of the error appears each time. I want the date/time stamp of other errors. — RedWizard75, May 20 '20 at 05:40
@RedWizard75 Please add this to your question as code instead of commenting. It's to hard to read and unclear where there are line endings. — stackprotector, May 20 '20 at 06:49

postanote · Accepted Answer · 2020-05-20T06:16:37.690

PowerShell is an object-oriented language, not text. Strings are just another object.

Based on your use case, you can do the below. Sure, maybe not as direct as you are showing in *nix, but PowerShell, of course, is not *nix and we have to do it the PowerShell way.

So this is what I came up with for you to consider. There are always a half dozen different ways to do X or Y thingy in PowerShell. Some more elegant than others.

Get-Content -Path 'D:\temp\abc.txt'

<#
# Results

a=abcdef123
b=ngh567
c=defh123
#>


Get-Content -Path 'D:\temp\abc.txt' -Tail 3 -Wait | 
ForEach{$PSItem -notmatch 'c'}

# After adding test to the file and saving
<#
# Results


False
True
False
True
True
#>

# After adding checking to the file and saving
<#
# Results


False
True
False
True
True
True
False
#>

Get-Content -Path 'D:\temp\abc.txt' -Tail 3 -Wait | 
ForEach{Select-String -InputObject $PSItem -NotMatch 'context'}

<#
# Results


a=abcdef123
b=ngh567
c=defh123
#>

# After adding a string to the file and saving

<#
# Results

testing
#>


# After adding context to the file and saving
# no response


# after adding a new filtered string

<#
# Results

after c*text
#>

# after adding 3 lines including 1 filtered string and saving

<#
# Results

blank line before c*text
line after c*text
#>

# What's in the file now
Get-Content -Path 'D:\temp\abc.txt'

<#
# Results

a=abcdef123
b=ngh567
c=defh123
testing
context
after c*text
blank line before c*text
context
line after c*text
#>

PowerShell Tail file but ignore lines matching pattern

1 Answers1