Powershell Email specific Error via log timestamp - powershell

Question

$log = "C:\bobloblawslawblog.log"
Get-Content $log |
? {$_.Modified -le $(Get-Date).AddHours(-4)} |
Select-String "TCP" -Context 1 |
% { #($_.Context.PreContext) + #($_.Line)}
{
$Workstation = hostname
$emailSmtpServer = "mail.server"
$emailFrom = "Error CODE 1234#$Workstation.com"
$emailTo = "my.name#my.company.com"
$emailSubject = "$Workstation Error CODE 1234"
$emailBody = "$Workstation experiencing Error Code 1234"
Send-MailMessage -To $emailTo -From $emailFrom -Subject $emailSubject -Credential $credentials -Body $emailBody -SmtpServer $emailSmtpServer
$credentials= New-Object System.Management.Automation.PSCredential ("username", $secpasswd)
}
I cannot seem to get this to grab the error from just the past 4hrs. The script grabs all the matching codes and sends them along.
The format of the timestamp in the log file is:
[2015-09-01 03:12:34,774] INFO com.server.mobilize.jte.service.listener.DesktopClientTransferListener(147) exception (Transport Protocol Seeker)- 218362: a warning or retriable exception has occurred Transfer warning: Error connecting to TCP Server-A/127.0.0.1:49221 relayed via Sever-B/External-IP:49221: Connection lost on tcp port read
I don't know what those last 3 numbers '975' indicate. It's not a pid.
What I want to do is have the script scrape a .log file - return a match from the last 4 hours and email an alert.
Ideally, I'd like the email body to include the actual error from the log.

Answer 1

Like I was saying in the comments you are trying access properties that don't exist in the pipeline. Get-Content returns a string array. Keep in mind that those whiles string do have special properties like linenumber there is no magical way that it interprets the date at the beginning. That is up to us.
Get-Content $log | ForEach-Object{
# Extract the date
$date = $null # Assume null
# Match the data that occurs after the bracket and before the comma. This can only be at the beginning of the line.
If($_ -match "^\[(.*?),"){
$date= [datetime]$matches[1]
}
# Build a new object as pass it along the pipe
New-Object -TypeName psobject -Property #{
Modified = $date
Line = $_
}
}
Many ways to do this but I opted for creating a new object where we give it a modified property. We use regex to extract the date from the beginning of the line and cast it to a [datetime] so that you can now perform date calculations.
Assuming the rest of your logic does what you want it to you just need to append it after the last } in my snippet above.
Something a little better
Making another object seemed like a waste of resources so I used the same logic in the Where instead. I have also added the Select-String portion of you code as well. I made some changes.
$results = Get-Content $log | Where-Object{
# Match the data that occurs after the bracket and before the comma. This can only be at the beginning of the line.
$date = $null
If($_ -match "^\[(.*?),"){$date = [datetime]$matches[1]}
$date -gt (Get-Date).AddHours(-4)
} | Select-String "tcp" -Context 1 | ForEach-Object{
"{0}`r`n{1}`r`n{2}" -f ($_.Context.Precontext -join "`r`n"), $_.line, ($_.context.postcontext -join "`r`n")
}
Now results will have just that. So you would see in there all entries that have occured in the last 4 hours that have the string "TCP" somewhere on the line. It will also include the line before and after the match. $results has the potential to be an array so you would need to account for that in your email. A simple $results -join "`r`n" would do it.