How to concatenate characters after recognition and interception in PowerShell - powershell

Question

I want to turn the following input:
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
ASL Module "com.apple.cdscheduler" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
ASL Module "com.apple.install" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
ASL Module "com.apple.callhistory.asl.conf" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
ASL Module "com.apple.authd" sharing output destination "/var/log/asl" with ASL Module "com.apple.asl".
Output parameters from ASL Module "com.apple.asl" override any specified in ASL Module "com.apple.authd".
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:
ASL Module "com.apple.mkb" sharing output destination "/private/var/log/keybagd.log" with ASL Module "com.apple.mkb.internal".
Output parameters from ASL Module "com.apple.mkb.internal" override any specified in ASL Module "com.apple.mkb".
into the following output:
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.cdscheduler" claims selected messages.Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.install" claims selected messages.Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.callhistory.asl.conf" claims selected messages.Those messages may not appear in standard system log files or in the ASL database.
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.authd" sharing output destination "/var/log/asl" with ASL Module "com.apple.asl".Output parameters from ASL Module "com.apple.asl" override any specified in ASL Module "com.apple.authd".
May 13 00:30:00 BBAOMACBOOKAIR2 syslogd[113]: Configuration Notice:ASL Module "com.apple.mkb" sharing output destination "/private/var/log/keybagd.log" with ASL Module "com.apple.mkb.internal".Output parameters from ASL Module "com.apple.mkb.internal" override any specified in ASL Module "com.apple.mkb".
That is, the indented lines should be joined to the preceding non-indented line.

Answer 1

I would first make sure it's a multi-line string (rather than an array of strings), then use RegEx to split based on the date/time stamp, and for each multi-line bit passed trim any whitespace from a line, and join the lines together into one line. That can be done with something like this
$LogText -join "`n" -split '[\r\n]+\s*(?=\w+ \d+ \d+:\d+:\d+)'|
ForEach-Object {$_.trimstart() -replace '[\r\n]+\s*'}

Answer 2

Assuming that your May ... lines have no leading whitespace:
If the file is small enough to fit into memory as a whole, combine Get-Content -Raw with the regex-based -replace operator (redirect the output to a file as needed; if the input text is already in memory, simply use it as the LHS):
(Get-Content -Raw file.log).TrimEnd() -replace '\r?\n\s+', ' '
Otherwise, use a switch statement with the -File and -Regex parameters:
& {
$mergedLine = ''
switch -Regex -File file.log {
'^\S' { # 'May ...' line, no leading whitespace.
if ($mergedLine) { $mergedLine } # output previous
$mergedLine = $_
}
default { # Subsequent, indented line (leading whitespace)
$mergedLine += ' ' + $_.TrimStart()
}
}
$mergedLine # output final merged line
}
Note:
For readability, the solutions above place a space char. between the merged (joined) lines; remove the use of ' ' from the code above to join them without a separator (as in the sample output in your question).
You can pipe the & { ... } solution to Set-Content for output, though if performance is paramount, you may want to use the System.IO.StreamWriter .NET type for faster writing, as shown in this answer.
An equivalent awk-based solution can be found in this answer to your follow-up question about a native macOS solution.