src/Filter-ObjectExcludeProperty.ps1

Function Filter-ObjectExcludeProperty
{
  <#
    .SYNOPSIS
    Removes columns from the object which is considered "noice" and shouldn't be send to logs
 
    .DESCRIPTION
    Ensures that the log schema and data looks nice and clean
 
    .VERSION
    1.0
 
    .AUTHOR
    Morten Knudsen, Microsoft MVP - https://mortenknudsen.net
 
    .LINK
    https://github.com/KnudsenMorten/AzLogDcrIngestPS
 
    .PARAMETER Data
    Object to modify
 
    .PARAMETER ExcludeProperty
    Array of columns to remove from the data object
 
    .INPUTS
    None. You cannot pipe objects
 
    .OUTPUTS
    Updated object
 
    .EXAMPLE
    #-------------------------------------------------------------------------------------------
    # Variables
    #-------------------------------------------------------------------------------------------
    $Verbose = $true
 
    #-------------------------------------------------------------------------------------------
    # Collecting data (in)
    #-------------------------------------------------------------------------------------------
    $DNSName = (Get-CimInstance win32_computersystem).DNSHostName +"." + (Get-CimInstance win32_computersystem).Domain
    $ComputerName = (Get-CimInstance win32_computersystem).DNSHostName
    [datetime]$CollectionTime = ( Get-date ([datetime]::Now.ToUniversalTime()) -format "yyyy-MM-ddTHH:mm:ssK" )
 
    $UserLoggedOnRaw = Get-Process -IncludeUserName -Name explorer | Select-Object UserName -Unique
    $UserLoggedOn = $UserLoggedOnRaw.UserName
 
    Write-Output "Get-Process is pretty slow .... take a cup coffee :-)"
    $DataVariable = Get-Process
 
    #-------------------------------------------------------------------------------------------
    # Preparing data structure
    #-------------------------------------------------------------------------------------------
    # convert CIM array to PSCustomObject and remove CIM class information
    $DataVariable = Convert-CimArrayToObjectFixStructure -data $DataVariable -Verbose:$Verbose
     
    # add CollectionTime to existing array
    $DataVariable = Add-CollectionTimeToAllEntriesInArray -Data $DataVariable -Verbose:$Verbose
 
    # add Computer & UserLoggedOn info to existing array
    $DataVariable = Add-ColumnDataToAllEntriesInArray -Data $DataVariable -Column1Name Computer -Column1Data $Env:ComputerName -Column2Name UserLoggedOn -Column2Data $UserLoggedOn -Verbose:$Verbose
 
    # we try to see the data in JSON format - and notice some columns, which we want to remote (noice)
    $DataVariable[0] | ConvertTo-Json
 
    # We remove unnecessary columns in schema (StartInfo, __NounName, Threads) for all records
    $DataVariable = Filter-ObjectExcludeProperty -Data $DataVariable -ExcludeProperty StartInfo, __NounName, Threads -Verbose:$Verbose
 
    # Now we can see, that data was removed - we have removed data, which aren't relevant
    $DataVariable[0] | ConvertTo-Json
 
    # Schema after changes - we see the 3 columns (StartInfo, __NounName, Threads) are gone
    Get-ObjectSchemaAsArray -Data $DataVariable -Verbose:$Verbose
       
    #-------------------------------------------------------------------------------------------
    # Output
    #-------------------------------------------------------------------------------------------
    name type
    ---- ----
    BasePriority int
    CollectionTime datetime
    Company dynamic
    Computer string
    Container dynamic
    CPU dynamic
    Description dynamic
    EnableRaisingEvents boolean
    ExitCode dynamic
    ExitTime dynamic
    FileVersion dynamic
    Handle int
    HandleCount int
    Handles int
    HasExited boolean
    Id_ string
    MachineName string
    MainModule dynamic
    MainWindowHandle int
    MainWindowTitle string
    MaxWorkingSet int
    MinWorkingSet int
    Modules dynamic
    Name string
    NonpagedSystemMemorySize int
    NonpagedSystemMemorySize64 int
    NounName dynamic
    NPM int
    PagedMemorySize int
    PagedMemorySize64 int
    PagedSystemMemorySize int
    PagedSystemMemorySize64 int
    Path string
    PeakPagedMemorySize int
    PeakPagedMemorySize64 int
    PeakVirtualMemorySize int
    PeakVirtualMemorySize64 int
    PeakWorkingSet int
    PeakWorkingSet64 int
    PM int
    PriorityBoostEnabled boolean
    PriorityClass int
    PrivateMemorySize int
    PrivateMemorySize64 int
    PrivilegedProcessorTime dynamic
    ProcessName string
    ProcessorAffinity int
    Product dynamic
    ProductVersion dynamic
    Responding boolean
    SafeHandle dynamic
    SessionId int
    SI int
    Site dynamic
    StandardError dynamic
    StandardInput dynamic
    StandardOutput dynamic
    StartTime datetime
    SynchronizingObject dynamic
    TotalProcessorTime dynamic
    Type_ string
    UserLoggedOn string
    UserProcessorTime dynamic
    VirtualMemorySize int
    VirtualMemorySize64 int
    VM int
    WorkingSet int
    WorkingSet64 int
    WS int
  #>


    [CmdletBinding()]
    param(
            [Parameter(mandatory)]
                [Array]$Data,
            [Parameter(mandatory)]
                [array]$ExcludeProperty
         )

    $Data = $Data | Select-Object * -ExcludeProperty $ExcludeProperty
    Return $Data
}