Basic PowerShell Script Issue: “Expressions are only allowed as the first element of a pipeline”

Anton Teremshonok

Please help me. Trying to use the variable as a value for subsequent processing does not work. I use it like this:

$SourceLog = 'System'
$Begin = "03/06/2021 10:50:54"
$End = "03/06/2021 13:50:54"

$file = "$PSScriptRoot\ignore.txt"
$DB = Get-Content $file

$arr = @(foreach ($Data in $DB) {
    $First, $Second, $Third, $Fourth = $Data -split ',' -replace '^\s*|\s*$'
    $fe="!(`$_.Source` -like '$First' -and `$_.EventID` -eq '$Second')"
    write-output "$fe"
})

$a = $arr -join " -and "
$a="($a)"
$a=write-output 'Where-Object -FilterScript {' "$a" '}'

write-host 1- $a

$request = Get-EventLog -LogName "$SourceLog" -After "$Begin" -Before "$End" | %{ $a } | Select-Object -Property Index,TimeWritten,EventID,Source,Message | Sort-Object -Descending TimeWritten | Sort-Object EventID,Source -Unique
write-output $request | ConvertTo-Json

the $a variable is not exposed. He also tried:

$request = Get-EventLog -LogName "$SourceLog" -After "$Begin" -Before "$End" |  Where-Object -FilterScript { $a } | Select-Object -Property Index,TimeWritten,EventID,Source,Message | Sort-Object -Descending TimeWritten | Sort-Object EventID,Source -Unique

File ignore.txt contains:

Zabbix test event,998
Zabbix test event1,998

create this events:

eventcreate /t ERROR /id 998 /l system /so "Zabbix test event" /d "Test ERROR event 999 log by Zabbix - $(Get-Date -UFormat "%m/%d/%Y - %T")" ; eventcreate /t ERROR /id 998 /l system /so "Zabbix test event1" /d "Test ERROR event 998 log by Zabbix - $(Get-Date -UFormat "%m/%d/%Y - %T")"

In one version, I get a void in the output, with different attempts to open the variable, sometimes I received an error message "Expressions are only allowed as the first element of a pipeline"

I tried to do as in the answer to the article, but it did not work: Basic PowerShell Script Issue: "Expressions are only allowed as the first element of a pipeline"

Guenther Schmitz

if I understand your script correct you want to get all eventlog entries but not those that match the pattern of "ignore.txt". to achive this you have to create ScriptBlock out of the string $a:

$a = $arr -join " -and "
$a="($a)"
# REMOVED: $a=write-output 'Where-Object -FilterScript {' "$a" '}'
$a = [Scriptblock]::Create($a)

and then use that ScriptBlock directly as FilterScript like:

$request = Get-EventLog -LogName "$SourceLog" -After "$Begin" -Before "$End" | Where-Object -FilterScript $a | Select-Object -Property Index,TimeWritten,EventID,Source,Message | Sort-Object -Descending TimeWritten | Sort-Object EventID,Source -Unique

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

Basic PowerShell Script Issue: "Expressions are only allowed as the first element of a pipeline"

Powershell - "Expressions are only allowed as the first element of a pipeline"

Simple Example: Expressions are only allowed as the first element of a pipeline

jQuery recursive script only works on the first element

Assignments are not expressions and only expressions are allowed in this context - Kotlin

ADF - Pipeline with powershell script

Powershell script in jenkins pipeline

PowerShell script to add first domain user [permissions issue]

Only one configSections element allowed per config file and if present must be the first child of the root configuration element

Javascript targeting the first element only with a double click issue

Powershell script returns only first value in Excel range

Only SubQuery expressions that are top level conjuncts are allowed

"Subqueries are not allowed in this context. Only scalar expressions are allowed."

for loop returns only first array element in bash script

My script is only executed to the first element on my dataframe Python

Why is my script only accessing the first element in array?

Why does my script only work on the first element with an ID?

numpy 2d: How to get the index of the max element in the first column for only the allowed value in the second column

PowerShell script issue

Powershell script syntax issue

strange script issue in Powershell

Run powershell script in devops pipeline

Only the first element is showing

Append only for first element

Only focus in the first element

Script will only run in Powershell

Powershell script taking only the first value from the variable while running the validation script of Azure webjobs

Attribute "integrity" not allowed on element "script" at this point

XML Only one root Element allowed