Powershell XML Parsing and writing to the event viewer

Question

I am trying to parse XML files in a directory where a keyword is defined. If the keyword is found, it should first be replaced to avoid further matching and then the contents of the xml will be sent as the message portion of an event.

The main issue is with the last code block, where it parses the .xml line by line instead of as a block.

#### THIS CODE GETS ALL THE FILES THAT CONTAINS THE "Major" Pattern
 $Path = "C:\test\"
 $SearchFor = "Major"
 $TestFor = "parsedxml"
 $Parse = "ParsedXML"
 $PathArray = @()
 $FolderFile = "C:\test\*.xml"
 $found = @()

 # This code snippet gets all the files in $Path that end in ".xml".
 Get-ChildItem $Path -Filter "*.xml" | Select-String -Pattern "Major" 
 ForEach-Object { 
     If (Get-Content $FolderFile | Select-String -Pattern
 "Major","Parsedxml") 
     {


     }
  }

#### THIS WORKS TO CHANGE THE KEYWORD IN THE FILE ###
Get-ChildItem C:\test\*.xml -recurse | ForEach {
  (Get-Content $_ | ForEach {$_ -replace "Major", "Parsed"}) | Set-Content $_ 
}


### THIS WORKS (KINDA) TO PARSE THE FILE INTO AN EVENTLOG ###
### BUT IT PARSES THE .XML LINE BY LINE FOR SOME REASON ####
Get-ChildItem C:\test\*.xml | ForEach {
(Get-Content $_)| ForEach { Write-EventLog –LogName Application –Source “Verint Alert” –EntryType Information –EventID 1 -Message ("Triggered Alarm" + ($_))
  }
  }

But I cannot seem to make the code do the following: Read the file, if it contains "Major" Parse the whole .xml as a "Write EventLog -Message" and once it is parsed, change the keyword Major to the word Parsed.

BTW, I am pretty sure your "Major" pattern is in a specific XML tag, and you should be able to work your file using XML format and XPath rather than a raw gc and select-string — Mat M, Apr 19 '15 at 00:08
not familiar with XPath yet.. this was something that was thrown on me that I had to try and pickup quick.. — Delaney, Apr 19 '15 at 01:08

Mat M · Accepted Answer · 2015-04-19T20:02:47.380

1

Your code reads line by line because you asked for it:

   (Get-Content $_)| ForEach { ...  }

will loop through each line of the file $_.

So I suppose you would prefer:

Get-ChildItem C:\test\*.xml | ForEach {
Write-EventLog –LogName Application –Source “Verint Alert” `
    –EntryType Information –EventID 1 `
    -Message ("Triggered Alarm" + (Get-Content $_))
}

BTW, you also need to filter the files you are working on.

Edit about filtering:

Stated you have something like <status>Major</status> in your file

$xmlfile=$_
$xml=[xml] (gc $xmlfile)
if ( $xml.SelectSingleNode("//status").'#text' -eq "Major") { 
    # Write-EventLog...
    $xml.SelectSingleNode("//status").'#text' = 'Parsed'
    $xml.Save($xmlfile)
}

edited Apr 19 '15 at 20:02

answered Apr 19 '15 at 00:24

Mat M

1,786
24
30

So I couldn't just process all the xmls via *.XML? how would I filter them otherwise? – Delaney Apr 19 '15 at 00:46
This was super helpful.. got me past one hurdle as far as parsing the file in its entirety.. but how would I "Filter" each of the files? – Delaney Apr 19 '15 at 01:06
Filtering is another question, especially in SO. I still added my piece of code to give you another path than the plain version of Keith Hill – Mat M Apr 19 '15 at 20:01

Keith Hill · Answer 2 · 2015-04-19T01:10:16.487

0

Another route to go is:

foreach ($file in (Get-ChildItem c:\test\*.xml)) {
    $content = [IO.File]::ReadAllText($file.FullName)
    if ($content -match 'Major') {
        Write-Event -LogName Application -Source 'Verint Alert' `
                    -EntryType Information -EventId 1 `
                    -Message "Triggered Alarm $content";
        $content -replace 'Major','Parsed' | Out-File $file.FullName
    }
}

In PowerShell v2 you don't have the -Raw parameter on Get-Content to read the file as a single string. You can use [IO.File]::ReadAllText() instead.

edited Apr 19 '15 at 01:10

answered Apr 19 '15 at 01:00

Keith Hill

194,368
42
353
369

I am limited to Powershell 2.0 – Delaney Apr 19 '15 at 01:02
Updated for PowerShell 2.0. – Keith Hill Apr 19 '15 at 01:08
BTW V2 is about 6 years old now and soon to be 3 revs back. Just sayin' :-) It's a bit harder to get help for old revs. I keep around VMs so I can check stuff on older versions but it's a pain. Right now I'm waiting for my V2 VM to finish installing 50+ updates. – Keith Hill Apr 19 '15 at 01:13
thanks.. I know... I work for "Big Brother" and things have to break before they are upgraded.. – Delaney Apr 20 '15 at 13:37
Nevermind.. this works.. AWESOME.. thank you SOOOOO Much. I have been racking my brain on this for too long... Totally own you a Beer! – Delaney Apr 20 '15 at 13:43

Powershell XML Parsing and writing to the event viewer

2 Answers2