PowerShell中如何排除含空值字段的已分组结果？

使用现有代码将日志文件解析为JSON格式时，部分分组存在字段缺失的情况，输出结果中会出现null值。需要修改代码，排除所有包含空值或字段不完整的分组。

原解析代码 #

Group-Object sessionid | Foreach-Object {
$jsonTemplate = [pscustomobject]@{
    time = [pscustomobject]@{ start = ''; duration = '' }
    group1 = ''
    host1 = '' 
    title1 = ''
    address = [pscustomobject]@{from = ''; to = ''}
    situation = ''
}
$start = ($_.Group | where key -eq 'title1').time
$end = ($_.Group | where key -eq 'situation').time -as [datetime]
$jsonTemplate.time.start = $begin
$jsonTemplate.time.duration = ($end - ($start -as [datetime])).ToString()
$jsonTemplate.group1 = $_.Name
$jsonTemplate.host1 = ($_.Group | where key -eq 'host1').data
$jsonTemplate.title1 = ($_.Group | where key -eq 'title1').data
$jsonTemplate.address.sender = ($_.Group | where key -eq 'sender').data
$jsonTemplate.address.reciever = ($_.Group | where key -eq 'reciever').data
$jsonTemplate.situation = ($_.Group | where key -eq 'situation').data
[regex]::Unescape(($jsonTemplate | convertTo-Json))
}

修改后的代码（排除不完整分组） #

Group-Object sessionid | Foreach-Object {
    # 定义所有必填的字段key
    $requiredKeys = @('title1', 'situation', 'host1', 'sender', 'reciever')
    # 检查当前分组是否包含所有必填key
    $hasAllKeys = ($requiredKeys | ForEach-Object {
        $null -ne ($_.Group | Where-Object key -eq $_)
    } | Where-Object { -not $_ } | Measure-Object).Count -eq 0

    # 检查时间字段是否有效
    $startEntry = $_.Group | Where-Object key -eq 'title1'
    $endEntry = $_.Group | Where-Object key -eq 'situation'
    $isTimeValid = $null -ne $startEntry.time -and $null -ne $endEntry.time -and ($endEntry.time -as [datetime]) -ne $null

    # 只有满足所有条件才生成JSON
    if ($hasAllKeys -and $isTimeValid) {
        $jsonTemplate = [pscustomobject]@{
            time = [pscustomobject]@{ start = ''; duration = '' }
            group1 = ''
            host1 = '' 
            title1 = ''
            address = [pscustomobject]@{from = ''; to = ''}
            situation = ''
        }
        $start = $startEntry.time -as [datetime]
        $end = $endEntry.time -as [datetime]
        $jsonTemplate.time.start = $start.ToString()
        $jsonTemplate.time.duration = ($end - $start).ToString()
        $jsonTemplate.group1 = $_.Name
        $jsonTemplate.host1 = ($_.Group | Where-Object key -eq 'host1').data
        $jsonTemplate.title1 = $startEntry.data
        $jsonTemplate.address.from = ($_.Group | Where-Object key -eq 'sender').data
        $jsonTemplate.address.to = ($_.Group | Where-Object key -eq 'reciever').data
        $jsonTemplate.situation = $endEntry.data
        [regex]::Unescape(($jsonTemplate | ConvertTo-Json))
    }
}

关键修改说明 #

• 新增必填字段校验：定义$requiredKeys列表，遍历确认当前分组包含所有必填的key条目
• 新增时间有效性校验：确保start和end时间能正常转换为datetime类型，避免时长计算出错
• 添加条件过滤逻辑：仅当分组满足所有必填字段存在且时间有效时，才生成并输出JSON，否则直接跳过该分组

内容的提问来源于stack exchange，提问作者John Clark