How to concatenate characters after recognition and interception in PowerShell

Question

I want to turn the following input:

May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
    ASL Module "com.apple.cdscheduler" claims selected messages.
    Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
    ASL Module "com.apple.install" claims selected messages.
    Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
    ASL Module "com.apple.callhistory.asl.conf" claims selected messages.
    Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
    ASL Module "com.apple.authd" sharing output destination "/var/log/asl" with ASL Module "com.apple.asl".
    Output parameters from ASL Module "com.apple.asl" override any specified in ASL Module "com.apple.authd".
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
    ASL Module "com.apple.mkb" sharing output destination "/private/var/log/keybagd.log" with ASL Module "com.apple.mkb.internal".
    Output parameters from ASL Module "com.apple.mkb.internal" override any specified in ASL Module "com.apple.mkb".

into the following output:

May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.cdscheduler" claims selected messages.Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.install" claims selected messages.Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.callhistory.asl.conf" claims selected messages.Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.authd" sharing output destination "/var/log/asl" with ASL Module "com.apple.asl".Output parameters from ASL Module "com.apple.asl" override any specified in ASL Module "com.apple.authd".
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.mkb" sharing output destination "/private/var/log/keybagd.log" with ASL Module "com.apple.mkb.internal".Output parameters from ASL Module "com.apple.mkb.internal" override any specified in ASL Module "com.apple.mkb".

That is, the indented lines should be joined to the preceding non-indented line.

Answer 1

I would first make sure it's a multi-line string (rather than an array of strings), then use RegEx to split based on the date/time stamp, and for each multi-line bit passed trim any whitespace from a line, and join the lines together into one line. That can be done with something like this

$LogText -join "`n" -split '[\r\n]+\s*(?=\w+ \d+ \d+:\d+:\d+)'|
    ForEach-Object {$_.trimstart() -replace '[\r\n]+\s*'}

Answer 2

Assuming that your May ... lines have no leading whitespace:

• If the file is small enough to fit into memory as a whole, combine Get-Content -Raw with the regex-based -replace operator (redirect the output to a file as needed; if the input text is already in memory, simply use it as the LHS):

(Get-Content -Raw file.log).TrimEnd() -replace '\r?\n\s+', ' '

• Otherwise, use a switch statement with the -File and -Regex parameters:

& {
  $mergedLine = ''
  switch -Regex -File file.log {
    '^\S' {  # 'May ...' line, no leading whitespace.
      if ($mergedLine) { $mergedLine } # output previous 
      $mergedLine = $_
    }
    default { # Subsequent, indented line (leading whitespace)
      $mergedLine += ' ' + $_.TrimStart()
    }
  }
  $mergedLine # output final merged line
}

Note:

• For readability, the solutions above place a space char. between the merged (joined) lines; remove the use of ' ' from the code above to join them without a separator (as in the sample output in your question).

• You can pipe the & { ... } solution to Set-Content for output, though if performance is paramount, you may want to use the System.IO.StreamWriter .NET type for faster writing, as shown in this answer.

An equivalent awk-based solution can be found in this answer to your follow-up question about a native macOS solution.