Powershell - Match one or another - powershell

Question

I have a log file that has user login/logout events, formatted like this:
11/29/19 10:46:41.976 S I [T-22156] - User Logout: Bob Jones (Home)
11/29/19 10:46:51.293 S I [T-22156] - HTTP UserMgr: Start User login notify for user: Jane Smith (Studio)
I am calling the above text from my log file using Get-Content and saving it to $testtext.
In Expresso, I built the following regex, and when I run it, Expresso matches my DateTime, Status, and Name without any errors on the above text.
$regex = [regex]::new('(?<DateTime>\d{2}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2})(?:.*)(?<Status>User\slog\w{2,3})(?:.*?)(?<Name>[A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+\s\([A-Z]+\))')
But when I run the following in Powershell, it only outputs the Login events
$parsed = foreach ($text in $testtext) {
$match = $regex.Match($text)
[PSCustomObject][ordered]#{
Date = $match.Groups["DateTime"].Value
Status = $match.Groups["Status"].Value
Name = $match.Groups["Name"].Value
}
}
$parsed | Out-GridView
How can I have my regex look at each line and fine both matches?

Answer 1

the following is what i meant by "two steps instead of one massive regex". [grin]
what it does ...
fakes reading in text file
replace that entire section with a Get-Content call to load your text file as an array of lines of text.
iterates thru the resulting collection of lines
tests for either login or logout
applies a different regex for each type of line
making a regex for both lines is both more complex and somewhat beyond my skill level. [grin]
creates a PSCO for each set of matches
sends the PSCO out to the $Results collection
displays that collection
at that point, you can export to CSV fairly simply.
the code ...
# fake reading in a plain text file
# in real life, use Get-Content
$InStuff = #'
11/29/19 10:46:41.976 S I [T-22156] - User Logout: Bob Jones (Home)
11/29/19 10:46:51.293 S I [T-22156] - HTTP UserMgr: Start User login notify for user: Jane Smith (Studio)
'# -split [System.Environment]::NewLine
$Results = foreach ($IS_Item in $InStuff)
{
if ($IS_Item -match 'login')
{
$Null = $IS_Item -match '^(.*\s.*) S I .* user (.*) notify for user: (.*)$'
[PSCustomObject]#{
TimeStamp = $Matches[1]
Type = $Matches[2]
User = $Matches[3]
}
}
if ($IS_Item -match 'logout')
{
$Null = $IS_Item -match '^(.*\s.*) S .* User (.*): (.*)$'
[PSCustomObject]#{
TimeStamp = $Matches[1]
Type = $Matches[2]
User = $Matches[3]
}
}
}
$Results
output ...
TimeStamp Type User
--------- ---- ----
11/29/19 10:46:41.976 Logout Bob Jones (Home)
11/29/19 10:46:51.293 login Jane Smith (Studio)

Answer 2

I maybe understanding it wrong. But it looks like the contents are only 1 object. Then when you do a foreach it only checks the one object.
What I would check...
What is the value of $testtext.count? You want it to match the number of lines, not be 1.
If it is 1, then you need to look at splitting each line to be treated as an object.