$skipDebug = $true $servers = @{ A = 'REJK-A-WEB201' C = 'REJK-C-WEB301' E = 'REJK-E-WEB401' Q = 'REJK-Q-WEB101','REJK-Q-WEB102' P = 'REJK-P-WEB003','REJK-P-WEB004' } $boris = $null if((hostname) -match 'REJK-(.)-.*') { $boris = $servers[$Matches[1]] } $logs = foreach($server in $boris) { Get-Item "\\$server\d-drive\ifsbosystem\log\borisws.log*" | sort lastwritetime } $result = foreach($log in $logs) { $content = Get-Content $log $current = $null $i = 0 foreach($line in $content) { $i++ # With ConsoleID # 2017-09-14 07:44:41.905 REJK-P-WEB003 [Thread 10652] WARN - [BFEBFBFF000306C37446A0B23EBB] - The translation of configuration ke........... if($line -match '([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}) ([a-z\-0-9]+) \[Thread ([0-9]+) *\] ([a-z]+) * - \[([a-z0-9]+)\] - (.*)') { if($current -ne $null) { Write-Output $current } $current = [pscustomobject]@{ Timestamp = $Matches[1] Server = $Matches[2] Thread = $Matches[3] Type = $Matches[4] ConsoleID = $Matches[5] Message = $Matches[6] Details = New-Object System.Collections.Generic.List`[string`] } if($skipDebug -and $current.Type -eq 'DEBUG') { $current = $null } continue } # No ConsoleID # 2017-09-14 07:44:42.061 REJK-P-WEB003 [Thread 8480 ] INFO - BORIS: session start if($line -match '([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}) ([a-z\-0-9]+) \[Thread ([0-9]+) *\] ([a-z]+) * - (.*)') { if($current.Message -like '*GVSS RETURN PARAMETERS*') { $next = $Matches[5] $null = $current.Details.Add($next) if($next -eq '}') { Write-Output $current $current = $null } continue } elseif($current -ne $null) { Write-Output $current } $current = [pscustomobject]@{ Timestamp = $Matches[1] Server = $Matches[2] Thread = $Matches[3] Type = $Matches[4] ConsoleID = $null Message = $Matches[5] Details = New-Object System.Collections.Generic.List`[string`] } if($skipDebug -and $current.Type -eq 'DEBUG') { $current = $null } continue } # Does not conform to any known pattern, assumed to be exception details and added to $current if($current -eq $null) { Write-Verbose -Message "Unable to add $line to current - current is null" -Verbose continue } $null = $current.Details.Add($line) if($i -eq $content.Length) { Write-Output $current } } } $result | sort timestamp | where { $_.type -ne 'debug' -and $_.message -notmatch 'performance monitoring' } | Out-GridView