在 PowerShell 中更改 XML 标记并保留内容. [英] Change XML tags within PowerShell and keep content.

问题描述

我已使用 PowerShell 从 EventLog 导出数据，并创建了一个示例架构以将数据导入 SQL，但是使用 ConvertToXML 从 PowerShell 导出数据的方式存在问题.

I have exported data from an EventLog using PowerShell and have created a sample Schema to import the data into SQL however there is an issue of the way the data is exported from PowerShell using ConvertToXML.

XML 的导出是这样的；

The exports of the XML looks like this;

<Property Name="Version">0</Property>

<Property Name="Qualifiers" />

<Property Name="Level">0</Property>

<Property Name="Task">14339</Property>

<Property Name="Opcode">0</Property>

<Property Name="Keywords">-9218868437227405312</Property>

<Property Name="RecordId">57963203</Property>

<Property Name="ProviderName">Microsoft-Windows-Security-Auditing</Property>

但它应该看起来像这样；

But it should look something like this;

<Version>0</Version>

<Qualifiers> />

<Level>0</Level>

<Task>14339</Task>

下面的代码标识了属性名称版本和属性标签的开始和结束并尝试将其更改为但不幸的是它更改了它而没有将内容保留在标签中.我似乎无法保持价值.

The code below identifies the start and end of the property name version and property tag and attempts to change it to but unfortunately it changes it without keeping the contents within the tag. I can't seem to kept the value.

$EventLog = (Get-WinEvent -ComputerName xxxxxxx-FilterXML $Query) | ConvertTo-Xml -NoTypeInformation

$EventLogModify = (Get-Content P:\EventTracking\Events.xml) | foreach{$_ -replace '(<Property Name=""Version"">(.*?)</Property>)', "<Version></Version>" };Set-Content P:\EventTracking\Events.xml $EventLogModify;

推荐答案

您的问题在

-replace '(<Property Name=""Version"">(.*?)</Property>)', "<Version></Version>"

您用一个空标签替换了一个完整的标签.我猜您想在替换中使用捕获的组:

You replace a complete tag by an empty tag. I guess you want to use the captured group in the replacement:

-replace '(<Property Name=""Version"">(.*?)</Property>)', '<Version>$2</Version>'

此外，您之前可能在正则表达式上使用了双引号，因为那里有 "" .这可能不会匹配任何内容，因为它现在会连续查找两个双引号.

Furthermore you probably used double quotes on the regex before, because there are "" in there. This likely won't match anything because it now looks for two double quotes in a row.

另一件事，你可能想一次全部替换，所以也许使用这个:

Another thing, you probably want to replace all at once, so use this maybe:

-replace '<Property Name="([^"]+)">([^<]+)</Property>', '<$1>$2</$1>'

但这还不够:

PS> $xml -replace '<Property Name="([^"]+)">([^<]+)</Property>', '<$1>$2</$1>'
<Version>0</Version>
<Property Name="Qualifiers" />
<Level>0</Level>
<Task>14339</Task>
<Opcode>0</Opcode>
<Keywords>-9218868437227405312</Keywords>
<RecordId>57963203</RecordId>
<ProviderName>Microsoft-Windows-Security-Auditing</ProviderName>

如您所见，Qualifiers 仍然没有改变.所以另一个替换:

As you can see, Qualifiers is still not changed. So another replace:

-replace '<Property Name="([^"]+)"\s*/>','<$1/>'

现在看起来好多了

PS> $xml -replace '<Property Name="([^"]+)">([^<]+)</Property>', '<$1>$2</$1>' -replace '<Property Name="([^"]+)"\s*/>','<$1/>'
<Version>0</Version>
<Qualifiers/>
<Level>0</Level>
<Task>14339</Task>
<Opcode>0</Opcode>
<Keywords>-9218868437227405312</Keywords>
<RecordId>57963203</RecordId>
<ProviderName>Microsoft-Windows-Security-Auditing</ProviderName>

这篇关于在 PowerShell 中更改 XML 标记并保留内容.的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！