Need a regex to find the word “ERROR:”, but not match “ERROR: Opening Local File”

Question

I'm writing an error checking script with PowerShell to look over Bitvise SFTP logs and alert if there are any errors. However, I don't want it to alert me on the string "ERROR: Opening Local File" as this is just telling be that the file already exists in the destination, which is expected. I'm not very good with regex and I can't seem to find the right combination of elements to find errors other than the one that we can ignore.

Example:

ERROR: Writing local file  (I want to be alerted to this)
ERROR: Opening local file  (I don't want to be alerted to this)

Answer 1

this seems to do what you want - it uses the way that PoSh can apply a regex match to an entire collection. [grin]

what it does ...

• creates a sample data set
  when ready to do this for real, replace the entire #region/#endregion block with a Get-Content call.
• sets the wanted pattern
• sets the unwanted pattern
• uses chained regex calls to exclude the unwanted and then to include the wanted
• assigns that to the $Result collection
• displays that on screen

the code ...

#region >>> fake reading in a text file
#    in real life, use Get-Content
$InStuff = @'
ERROR: Writing local file  (I want to be alerted to this)
ERROR: Opening local file  (I do not want to be alerted to this)
INFO: Some other thing
ERROR: Yet another thing
INFO: A thing that is wanted
WARNING: Something that may be wanted
'@ -split [System.Environment]::NewLine
#endregion >>> fake reading in a text file

$TargetPattern = 'error:'
$NotWantedPattern = ': opening local file'

$Result = $InStuff -notmatch $NotWantedPattern -match $TargetPattern

$Result

output ...

ERROR: Writing local file  (I want to be alerted to this)
ERROR: Yet another thing

Answer 2

As @spikey_richie says, you need negative lookahead:

ERROR: (?!Opening local file)

Basically, instead of specifying what you're looking for, you specify what you don't want, and wrap that inside (?! and ).

Demo

Answer 3

Something like that should work too : Demo

$MyString = @'
ERROR: Writing local file  (I want to be alerted to this)
ERROR: Opening local file  (I don't want to be alerted to this)
INFO: Some other thing
ERROR: Yet another thing
INFO: A thing that is wanted
WARNING: NOT a not-wanted thing
'@ -split [System.Environment]::NewLine

$pattern = 'ERROR: (?!Opening local file).+'
$MyString | %{ [regex]::matches($_,$pattern) } | %{ $_.Groups[0].Value }

Answer 4

This situation is similar to those presented in The Greatest Regex Trick Ever --- a great read for anyone learning regex. Whie the negative lookahead posted by Glorfindel works well in this case, this technique is easily expandable to multiple exclusions, lookbehinds combined with lookaheads, etc. and still remain readable. The essence of the trick is to capture all exclusions in the overall match and the desired content in Group 1. For the OP, the regex would look like:

'ERROR: Opening local file|(ERROR:.+$)'

Sample:
(In working code, <Here-string> -Split "`n"
would be replaced by:
Get-Contnet 'c:\Path\To\Error.log' )

@'
ERROR: Another error
ERROR: Writing local file  (I want to be alerted to this)
ERROR: Opening local file  (I don't want to be alerted to this)
THIS is not an error
'@ -Split "`n" | ForEach {
    $_ -match 'ERROR: Opening local file|(ERROR:.+$)' | out-null
    $matches[1]
}

Screen Capture:

PS C:\> @'
>> ERROR: Another error
>> ERROR: Writing local file  (I want to be alerted to this)
>> ERROR: Opening local file  (I don't want to be alerted to this)
>> THIS is not an error
>> '@ -Split "`n" | ForEach {
>>     $_ -match 'ERROR: Opening local file|(ERROR:.+$)' | out-null
>>     $matches[1]
>> }
ERROR: Another error
ERROR: Writing local file  (I want to be alerted to this)
PS C:\>

Again, the beauty of this technique is it's easily expandable: 'Exception1|Exception2|Exception3|(Desired Match)'