A regular expression, or regex, is a pattern notation for matching specified text. It is especially useful when filtering or extracting information from larger text files such as web-server logs. section 21.1 section 21.0
Use a regex to recognize a text pattern, not to prove that the data is valid. For example, an IPv4 pattern can recognize 211.193.299.299 even though that address is invalid. section 21.1
Build patterns from literal text and special characters:
- Literal text matches that text; PowerShell's default matching is case-insensitive, so Car matches car and CAR. section 21.2
- \w matches a word character, \d a digit, and \s whitespace; uppercase forms such as \W, \D, and \S match the opposites. section 21.2
- Use . for any single character, brackets such as [aeiou] for a character set, ranges such as [a-z], and [^...] for exclusion. section 21.2
- Use ?, *, and + to control repetition; parentheses group a subexpression, and backslash escapes a character that normally has special meaning. section 21.2
Test a pattern with -Match
PowerShell's -Match comparison operator returns True or False. Try: "car" -match "c[aeiou]r" returns True; "caaar" -match "c[aeiou]+r" returns True; "cjinr" -match "c[aeiou]+r" returns False. Use -CMatch when a case-sensitive comparison is needed. section 21.3
Search web-server logs
To find HTTP 400–409 errors without matching filenames such as error401.html, search for whitespace around the status code: get-childitem -filter *.log -recurse | select-string -pattern "\s40[0-9]\s" | format-table Filename,LineNumber,Line -wrap. Select-String returns matching lines with file and line information that can be redirected into a report. section 21.4
Regular expressions can also locate browser strings, event-log account names, email addresses, and other recurring text. Start with simple patterns rather than attempting complex expressions immediately; more advanced uses include Switch, input validation, and the automatic $matches collection. section 21.1 section 21.7
Practice by applying patterns to administrative data:
- Find files whose names contain a two-digit number. section 21.5
- Filter modules by Microsoft-related properties and display their name, version, author, and company. section 21.5
- Select installation lines from Windows Update or package-history logs, and find IPv4 addresses in DNS cache or HOSTS-file entries. section 21.5
