Parsing unformatted log file and exporting it into CSV - powershell

Question

I have tried couple of things, didn't tried using regex bcoz I am not good with this. The log file looks exactly like this.
timestamp : 2018121
streams : Total : 579 461 0 0 24 80 0
ABC : 630
A-1 : 98
B-2 : 87
C-3 : 0
timestamp : 2018127
stream : Total : 476 372 0 0 20 74 0 10 0
ABC : 511
B-2 : 77
C-3 : 0
D-4: 86
timestamp : 2018128
stream : Total : 76 37 0 0 20 74 0 10 0
ABC : 517
A-1 : 74
C-3 : 9
D-4 : 18
I am trying to export in csv in a transpose manner. For streams I just want to export only the first value.
timestamp streams ABC A-1 B-2 C-3 D-4
2018121 579 630 98 87 0 NULL
2018127 476 511 NULL 77 0 186
2018128 76 517 74 NULL 9 18

Answer 1

Hi i think you have to perform your proper logic code because your file was soo tipycal i have work around 10 minutes you have this result it's small code snapp
i have done some change in input because you have in line streams and in other stream ... and in line ' ' and in other ' ' ? soo i think you have a issues in your log generator.
Input :
timestamp : 2018121
streams : Total : 579 461 0 0 24 80 0
ABC : 630
A-1 : 98
B-2 : 87
C-3 : 0
timestamp : 2018127
stream : Total : 476 372 0 0 20 74 0 10 0
ABC : 511
B-2 : 77
C-3 : 0
D-4: 86
timestamp : 2018128
stream : Total : 76 37 0 0 20 74 0 10 0
ABC : 517
A-1 : 74
C-3 : 9
D-4 : 18
Some Code :
$fileContent = Get-Content "C:\Temp\logTest.log"
$resultTab = #();
$beginIdentifierRows = "timestamp".ToLower();
for($i = 0; $i -lt $fileContent.Length; $i++){
if($fileContent[$i].ToLower().StartsWith($beginIdentifierRows)){
#Read all rows value strams to D-4 or other
$A1 = "NULL";
$B2 = "NULL";
$C3 = "NULL";
$D4 = "NULL";
$streams= "NULL";
$ABC = "NULL";
$timestamp = $fileContent[$i].Split(":")[1];
# Write-Host $fileContent[$i];
$jj = 0;
for($j = $i + 1; $j -lt ($i + 6); $j++){
$lineContentJ = $fileContent[$j].Replace(" "," ").Replace(" "," ").Replace(" "," ").Replace(" "," ").Replace(" "," ");
# $lineContentJ
switch -Wildcard ($lineContentJ) {
"ABC *"{
# streams todo
$ABC = $lineContentJ.Split(":")[1];
break;
}
"stream*"{
# streams todo
$streams = $lineContentJ.Split(":")[2].Split(" ")[1];
break;
}
"A-1 *"{
# A-1 todo
$A1 = $lineContentJ.Split(":")[1];
break;
}
"B-2 *"{
# B-2 todo
$B2 = $lineContentJ.Split(":")[1];
break;
}
"C-3 *"{
# C-3 todo
$C3 = $lineContentJ.Split(":")[1];
break;
}
"D-4 *"{
# D-4 todo
$D4 = $lineContentJ.Split(":")[1];
break;
}
}$jj = $j;
}
$i=$jj;
$array_name = [pscustomobject]#{timestamp = $timestamp; streams = $streams; ABC = $ABC; "A-1" = $A1; "B-2"=$B2; "C-3" = $C3; "D-4"=$D4}
$resultTab += $array_name;
}
#else {
#Do nothing
#}
}
$resultTab | ft;
RESULT :
timestamp streams ABC A-1 B-2 C-3 D-4
--------- ------- --- --- --- --- ---
2018121 579 630 98 87 0 NULL
2018127 476 511 NULL 77 0 86
2018128 76 517 74 NULL 9 18