在PowerShell中编译组之后，如何将组排除在输出之外？

Question

我使用以前的代码(Convert a Log file to JSON file)将日志文件解析为JSON。但是，某些组中的部分字段不可用，并在输出中的分组中显示为"null“。如果其中一个字段包含空或不完整组字段，如何排除整个组？

| Group sessionid | Foreach-Object {
$jsonTemplate = [pscustomobject]@{
    time = [pscustomobject]@{ start = ''; duration = '' }
    group1 = ''
    host1 = '' 
    title1 = ''
    address = [pscustomobject]@{from = ''; to = ''}
    situation = ''
}
$start = ($_.Group | where key -eq 'title1').time
$end = ($_.Group | where key -eq 'situation').time -as [datetime]
$jsonTemplate.time.start = $begin
$jsonTemplate.time.duration = ($end - ($start -as [datetime])).ToString()
$jsonTemplate.group1 = $_.Name
$jsonTemplate.host1 = ($_.Group | where key -eq 'host1').data
$jsonTemplate.title1 = ($_.Group | where key -eq 'title1').data
$jsonTemplate.address.sender = ($_.Group | where key -eq 'sender').data
$jsonTemplate.address.reciever = ($_.Group | where key -eq 'reciever').data
$jsonTemplate.situation = ($_.Group | where key -eq 'situation').data
[regex]::Unescape(($jsonTemplate | convertTo-Json))

Answer 1

不是最漂亮的代码，但是这样的代码应该能工作。

If(($_.Name -ne $Null -or $_.Name -ne "") -or (($_.Group | where key -eq 'client').data -ne $Null -or ($_.Group | where key -eq 'client').data -ne "") -or (($_.Group | where key -eq 'message-id').data -ne $Null -or ($_.Group | where key -eq 'message-id').data -ne "") -or (($_.Group | where key -eq 'from').data -ne $Null -or ($_.Group | where key -eq 'from').data -ne "") -or (($_.Group | where key -eq 'to').data -ne $Null -or ($_.Group | where key -eq 'to').data -ne "") -or (($_.Group | where key -eq 'status').data -ne $Null -or ($_.Group | where key -eq 'status').data -ne "") -or )
{
    $jsonTemplate.time.start = $start
    $jsonTemplate.time.duration = ($end - ($start -as [datetime])).ToString()
    $jsonTemplate.sessionid = $_.Name
    $jsonTemplate.client = ($_.Group | where key -eq 'client').data
    $jsonTemplate.messageid = ($_.Group | where key -eq 'message-id').data
    $jsonTemplate.address.from = ($_.Group | where key -eq 'from').data
    $jsonTemplate.address.to = ($_.Group | where key -eq 'to').data
    $jsonTemplate.status = ($_.Group | where key -eq 'status').data
    [regex]::Unescape(($jsonTemplate | convertTo-Json))
}

它检查每一个是否为空或空。

Answer 2

这也许能行。对不起，我没有数据来测试它。

| $Groups = Group-Object -Property sessionid

# Create an empty array to fill
$Array = @()

# Loop over each group
foreach ($Group in $Groups) {
   # Create an object
   $jsonTemplate = [pscustomobject]@{
      time = [pscustomobject]@{ start = ''; duration = '' }
      sessionId = ''
      client = ''
      messageId = ''
      address = [pscustomobject]@{from = ''; to = ''}
      status = ''
   }

   # Get the group's data
   $Data = $Group.Group
   
   # messageId
   $messageId = $Data | Where-Object {$_.key -eq 'messageId'}
   if ($messageId) {
      $jsonTemplate.messageId = $messageId.data
      [datetime]$start = $messageId.Time
   } else {continue}

   # status
   $status = $Data | Where-Object {$_.key -eq 'status'}
   if ($status) {
      $jsonTemplate.status = $status.data
      [datetime]$end = $status.Time
   } else {continue}

   # sessionid
   if ($Group.Name) {$jsonTemplate.sessionid = $Group.Name} else {continue}

   # client
   $client = $Data | Where-Object {$_.key -eq 'client'}
   if ($client) {$jsonTemplate.client = $client.data} else {continue}

   # from
   $from = $Data | Where-Object {$_.key -eq 'from'}
   if ($from) {$jsonTemplate.address.from = $from.data} else {continue}

   # to
   $to = $Data | Where-Object {$_.key -eq 'to'}
   if ($to) {$jsonTemplate.address.to = $to.data} else {continue}

   # Add to array
   $Array += $jsonTemplate
}

# Convert the array
$json = $Array | ConvertTo-Json -Depth 10

# Do stuff with the json
[regex]::Unescape($json)