如何在PowerShell中从日志文件提取指定格式的错误信息？

# 配置基础参数
$dir = 'C:\ProgramData\AecorsoftDataIntegrator\logs\'
$logAnalyticsWorkspaceId = "你的工作区ID"
$logAnalyticsSharedKey = "你的共享密钥"
$logType = "ApplicationErrorLogs" # 自定义日志类型，可按需修改

# 获取最新的2022开头日志文件
$targetLogFile = Get-ChildItem -Path $dir -Filter '2022*.log' | 
                 Sort-Object LastWriteTime -Descending | 
                 Select-Object -First 1

# 处理无匹配文件的情况
if (-not $targetLogFile) {
    Write-Warning "未找到符合条件的日志文件"
    exit
}

# 定义正则匹配规则，适配日志格式：[时间] [作业名称] 错误内容
$errorPattern = '\[(?<ErrorTime>[^\]]+)\] \[(?<JobName>[^\]]+)\] (?<ErrorMessage>.*error.*)'

# 提取错误信息并整理为结构化对象
$errorEntries = Get-Content $targetLogFile.FullName | 
                Select-String -Pattern $errorPattern -CaseSensitive:$false | 
                ForEach-Object {
                    [PSCustomObject]@{
                        ErrorTime    = $_.Matches.Groups['ErrorTime'].Value
                        JobName      = $_.Matches.Groups['JobName'].Value
                        ErrorMessage = $_.Matches.Groups['ErrorMessage'].Value
                        LogFileName  = $targetLogFile.Name
                    }
                }

# 处理无错误内容的情况
if (-not $errorEntries) {
    Write-Host "目标日志文件中未发现错误内容"
    exit
}

# 转换为Azure可接收的JSON格式
$jsonPayload = $errorEntries | ConvertTo-Json -Depth 10

# 构建Azure Log Analytics请求签名（符合身份验证要求）
$date = [DateTime]::UtcNow.ToString("r")
$stringToHash = "POST`n$($jsonPayload.Length)`napplication/json`nx-ms-date:$date`n/api/logs"
$sha256 = New-Object System.Security.Cryptography.HMACSHA256
$sha256.Key = [Convert]::FromBase64String($logAnalyticsSharedKey)
$signature = [Convert]::ToBase64String($sha256.ComputeHash([Text.Encoding]::UTF8.GetBytes($stringToHash)))
$authorizationHeader = "SharedKey $logAnalyticsWorkspaceId`:$signature"

$headers = @{
    "Authorization" = $authorizationHeader
    "Log-Type"      = $logType
    "x-ms-date"     = $date
    "Content-Type"  = "application/json"
}

# 发送数据到Azure Log Analytics
try {
    Invoke-RestMethod -Uri "https://$logAnalyticsWorkspaceId.ods.opinsights.azure.com/api/logs?api-version=2016-04-01" `
                      -Method Post `
                      -Headers $headers `
                      -Body $jsonPayload `
                      -ErrorAction Stop
    Write-Host "错误日志已成功发送到Azure Log Analytics"
}
catch {
    Write-Error "发送失败：$_"
}

关键部分说明 #

• 日志筛选逻辑：按最后修改时间倒序取最新日志，增加了空值判断避免脚本报错
• 正则匹配规则：精准捕获错误时间、作业名称、完整错误信息三个核心字段，若日志格式有变化，只需调整正则表达式即可适配
• Azure请求处理：实现了官方要求的签名验证，确保数据能正常写入工作区；$logType定义的名称将作为Azure中日志查询的表名
• 异常处理：覆盖了无日志、无错误、发送失败三种常见场景，便于排查问题

注意事项 #

• 生产环境请勿明文存储共享密钥，建议通过Azure Key Vault或环境变量读取
• 若错误信息存在跨多行的情况，需将Get-Content替换为Get-Content -Raw，同时修改正则表达式支持多行匹配

内容的提问来源于stack exchange，提问作者Aniket Chaudhuri