Regex to look for 40x error in log file does not return any result-CodePudding

I have a sample log file like below

02:49:12 127.0.0.1 GET / 200
02:49:35 127.0.0.1 GET /index.html 200
03:01:06 127.0.0.1 GET /images/sponsered.gif 304
03:52:36 127.0.0.1 GET /search.php 200
04:17:03 127.0.0.1 GET /admin/style.css 200
05:04:54 127.0.0.1 GET /favicon.ico 404
05:38:07 127.0.0.1 GET /js/ads.js 200

I use the pattern below to match the 40x error but it did not return any result. \s is to match any whitespace.

get-childitem -filter *.log -recurse | select-string -pattern "\s40[0-9]\s"

I dont understand why it does not work. Can someone please help to clarify?

CodePudding user response：

There's no whitespace at the end. Looks like select-string acts like get-content, reading each line without including the line ending.

get-childitem file.log | select-string -pattern "\s40[0-9]"

file.log:6:05:04:54 127.0.0.1 GET /favicon.ico 404

It would work with get-content -raw, the line ending being a whitespace (\r\n). But then it returns the whole file. Powershell 7 highlights the match.

get-content -raw file.log | select-string -pattern "\s40[0-9]\s"

02:49:12 127.0.0.1 GET / 200
02:49:35 127.0.0.1 GET /index.html 200
03:01:06 127.0.0.1 GET /images/sponsered.gif 304
03:52:36 127.0.0.1 GET /search.php 200
04:17:03 127.0.0.1 GET /admin/style.css 200
05:04:54 127.0.0.1 GET /favicon.ico 404
05:38:07 127.0.0.1 GET /js/ads.js 200