Select Some Strings From Event message - powershell

Question

I am trying to pull all username,time created and public ip address from
Microsoft-Windows-TerminalServices-Gateway/Operational event.
I get all the events from messages with below command but I need only username,and ip
get-winevent -FilterHashtable #{Logname = "Microsoft-Windows-TerminalServices-Gateway/Operational" ; ID = 300,302,303}
Trying with this No luck
get-winevent -FilterHashtable #{Logname = "Microsoft-Windows-TerminalServices-Gateway/Operational" ; ID = 300,302,303}| select timecreated -expand Message [regex]::Match($event, 'user:\s*(.*)\s*').Groups[1].Value

Answer 1

Ok, I can see what you're trying with the Select command, and while it sounds good, that doesn't quite work. What you could do instead is pass it through a Where statement matching the string you need, and capturing the relevant data in a RegEx match, then using Select to add those fields onto the object.
So a Where match that would work for you should be:
| Where{$_.Message -match '"(.+?\\.+?)".+"(\d+\.\d+\.\d+\.\d+)"'}
Then you pipe to Select and build the User and IPAddress properties on the fly like this:
| Select TimeCreated,#{l='User';e={$Matches[1]}},#{l='IPAddress';e={$Matches[2]}}
Then you put it all together and you get:
get-winevent -FilterHashtable #{Logname = "Microsoft-Windows-TerminalServices-Gateway/Operational" ; ID = 300,302,303} | Where{$_.Message -match '"(.+?\\.+?)".+"(\d+\.\d+\.\d+\.\d+)"'} | Select TimeCreated,#{l='User';e={$Matches[1]}},#{l='IPAddress';e={$Matches[2]}}
Using that with some randomized values I was able to output:
TimeCreated User IPAddress
----------- ---- ---------
9/14/2016 9:47:29 AM DOMAIN\dhxrjqb 216.229.149.87
9/14/2016 9:47:29 AM DOMAIN\fkoilrh 236.65.23.77
9/14/2016 9:47:29 AM DOMAIN\mvibope 20.7.45.231
Ok, the solution to the issue that you noted in your comment is a minor tweak to the RegEx match to make one portion not greedy. This would do that:
| Where{$_.Message -match '"(.+?\\.+?)".+?"(\d+\.\d+\.\d+\.\d+)"'}
and all together again...
get-winevent -FilterHashtable #{Logname = "Microsoft-Windows-TerminalServices-Gateway/Operational" ; ID = 300,302,303} | Where{$_.Message -match '"(.+?\\.+?)".+?"(\d+\.\d+\.\d+\.\d+)"'} | Select TimeCreated,#{l='User';e={$Matches[1]}},#{l='IPAddress';e={$Matches[2]}}

Answer 2

I think there's a better approach using the ToXml() Method on the EventLogRecord Object:
First Catch the Events:
$Events = Get-WinEvent -FilterHashtable #{Logname = "Microsoft-Windows-TerminalServices-Gateway/Operational" ; ID = 300,302,303}
Then, Take for example the first item in the array and convert it to XML:
[xml]$Event = $Events[0].ToXml()
Now you can see all the Information you need:
$Event.Event.UserData.EventInfo
Update: Set it for you, this should do the work:
$Events = Get-WinEvent -FilterHashtable #{Logname = "Microsoft-Windows-TerminalServices-Gateway/Operational" ; ID = 300,302,303}
$ArrayList = New-Object System.Collections.ArrayList
Foreach ($Event in $Events)
{
[xml]$Xml = $Event.ToXml()
$Row = "" | Select Username,TimeCreated,IPAddress
$Row.Username = $Xml.Event.UserData.EventInfo.Username
$Row.TimeCreated = $Event.TimeCreated.ToString()
$Row.IPAddress = $Xml.Event.UserData.EventInfo.IpAddress
[void]$ArrayList.Add($Row)
}
$ArrayList