Skip to content

Instantly share code, notes, and snippets.

@JohnLBevan
Created October 16, 2020 11:12
Show Gist options
  • Save JohnLBevan/a8c00114a3e6ccb1965b9fa0dd250a24 to your computer and use it in GitHub Desktop.
Save JohnLBevan/a8c00114a3e6ccb1965b9fa0dd250a24 to your computer and use it in GitHub Desktop.
Regex to parse IIS Logs
pushd C:\inetpub\logs\LogFiles\W3SVC1
[Regex]$regex = '^(?<date>[\d-]+)\s(?<time>[\d\:]+)\s(?<ServerIP>[\d\.]+)\s(?<method>\S+)\s(?<path>\S+)\s(?<querystring>\S+)\s(?<port>\d+)\s(?<username>\S+)\s(?<clientIP>[\d\.]+)\s(?<browser>\S+)\s(?<fulluri>\S+)\s(?<HttpStatus>\d+)\s(?<a>\d+)\s(?<b>\d+)\s(?<c>\d+)$'
cat 'u_ex201015.log' | ?{$_ -like '2020-10-15 07*'} | %{
if ($_ -match $regex) {
([PSCustomObject]$Matches)
} else {
throw "Unexpected line format: '$_'"
}
} | ft time, ClientIP, username, httpstatus, port, path, querystring -AutoSize
popd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment