Query Process ID (PID) from Windows Event Log - windows

Question

I am trying to write a query that will extract the Process ID (PID) from a Windows Event log.
I'm dealing with Windows event ID: 1309
I have written several scripts that get me close but none that get me home. This one has come the closest:
Get-EventLog -LogName Application -Source 'ASP.NET 4.0.30319.0' -EntryType Warning -Newest 1 |
where eventid -eq 1309 |
Select message |
Format-List |
Out-File c:\temp\elogdata.txt
Select-String c:\temp\elogdata.txt -Pattern "process id:" -SimpleMatch
This is the output that I get:
C:\temp\elogdata.txt:20: Process ID: 7332
I need to pipe that "7332" , from the "Process ID:" into another command such as TaskKill or ProcDump.
Strangely enough, when I try and run the Select-String on the output in memory I get nothing:
Get-EventLog -LogName Application -Source 'ASP.NET 4.0.30319.0' -EntryType Warning -Newest 1 |
where eventid -eq 1309 |
Select message |
Format-List |
Select-String -InputObject {$_} -Pattern "process id:"
I have also tried several Get-WinEvent scripts...
Get-WinEvent -FilterHashtable #{LogName='application';ID='1309'} -MaxEvents 1 |
Format-List |
select message

Answer 1

Never use Format-* cmdlets when further processing of your data is intended. What you want to do is expand the Message property and adjust your pattern, so that you extract the actual PID instead of the entire line. You also don't want to use a simple match here.
... |
Select-Object -Expand Message |
Select-String -Pattern '(?<=process id:\s+)\d+' |
Select-Object -Expand Matches |
Select-Object -Expand Value
($<=...) is a so-called positive lookbehind assertion that allows you to match something in your string without including that in the match that is returned. Essentially the pattern means "match \d+ only if it's preceded by that other string".