1

I am trying to sort the following log file according to the InvokeID. It is the last column. The Column although has no header so I can't filter it according to the name. I tried to filter it with the position of the number in the row, sadly didn't find a solution

11:20:36:645 ra-agi Trace: Sending Query Request message to application gateway host.     11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5000  11:20:36:645 ra-agi Trace:     InvokeID =             11359032 
11:20:36:645 ra-agi Trace: Received Query Confirm message from application gateway host.  11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5001  11:20:36:645 ra-agi Trace:     InvokeID =             11359018 
11:20:36:645 ra-agi Trace: Received Query Confirm message from application gateway host.  11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5001  11:20:36:645 ra-agi Trace:     InvokeID =             11359017 
11:20:36:645 ra-agi Trace: Sending Query Request message to application gateway host.     11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5000  11:20:36:645 ra-agi Trace:     InvokeID =             11359033 
11:20:36:645 ra-agi Trace: Received Query Confirm message from application gateway host.  11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5000  11:20:36:645 ra-agi Trace:     InvokeID =             11359032
Sage Pourpre
  • 9,932
  • 3
  • 27
  • 39
fbe106360
  • 71
  • 1
  • 6

1 Answers1

4

The log shows no real recognizable columns and seems to prepend values with lots of spaces. You could see this as a Fixed-Width table and use my ConvertFrom-FixedWidth function, but the code below should do what you want:

Get-Content -Path 'TheLogFile.log' | Sort-Object @{Expression = { [int]($_.Trim() -split '\s+')[-1] }}

Result:

11:20:36:645 ra-agi Trace: Received Query Confirm message from application gateway host.  11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5001  11:20:36:645 ra-agi Trace:     InvokeID =             11359017 
11:20:36:645 ra-agi Trace: Received Query Confirm message from application gateway host.  11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5001  11:20:36:645 ra-agi Trace:     InvokeID =             11359018 
11:20:36:645 ra-agi Trace: Sending Query Request message to application gateway host.     11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5000  11:20:36:645 ra-agi Trace:     InvokeID =             11359032 
11:20:36:645 ra-agi Trace: Received Query Confirm message from application gateway host.  11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5000  11:20:36:645 ra-agi Trace:     InvokeID =             11359032
11:20:36:645 ra-agi Trace: Sending Query Request message to application gateway host.     11:20:36:645 ra-agi Trace:     ApplicationGatewayID = 5000  11:20:36:645 ra-agi Trace:     InvokeID =             11359033
Theo
  • 57,719
  • 8
  • 24
  • 41
  • You might want to explain the -1. First time I see a usefull case to use it. – Lieven Keersmaekers Feb 03 '20 at 11:15
  • 2
    @LievenKeersmaekers The `[-1]` is indexing the last item in the array. As [the docs](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arrays?view=powershell-7) explain: _Negative numbers count from the end of the array. For example, "-1" refers to the last element of the array. To display the last three elements of the array, in index ascending order, type: `$theArray[-3..-1]`_ – Theo Feb 03 '20 at 13:05
  • yes I know, it was more meant as an invitation to add an explanation in your answer ;) – Lieven Keersmaekers Feb 03 '20 at 17:26