Public/ConvertFrom-CloudFrontExtendedLog.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
function ConvertFrom-CloudFrontExtendedLog {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory, ValueFromPipeline)]
        [ValidateNotNullOrEmpty()]
        [string[]]
        $InputObject
    )

    process {
        # Documentation of format: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html#BasicDistributionFileFormat
        $InputObject | ForEach-Object {
            if ($_ -match
                    '(?x)
                    ^
                    (?<Date>\S+)\s
                    (?<Time>\S+)\s
                    (?<EdgeLocation>\S+)\s
                    (?<Size>\S+)\s
                    (?<SourceIp>\S+)\s
                    (?<Method>\S+)\s
                    (?<CloudFrontHost>\S+)\s
                    (?<Path>\S+)\s
                    (?<Code>\S+)\s
                    (?<Referrer>\S+)\s
                    (?<UserAgent>\S+)\s
                    (?<Query>\S+)\s
                    (?<Cookie>\S+)\s
                    (?<EndResult>\S+)\s
                    (?<CacheId>\S+)\s
                    (?<Host>\S+)\s
                    (?<Protocol>\S+)\s
                    (?<RequestSize>\S+)\s
                    (?<Duration>\S+)\s
                    (?<ForwardedFor>\S+)\s
                    (?<SslProcotol>\S+)\s
                    (?<SslCipher>\S+)\s
                    (?<BeginResult>\S+)\s
                    (?<ProtocolVersion>\S+)\s
                    (?<FleStatus>\S+)\s
                    (?<FleEncryptedFields>\S+)
                    $
                    '

                ) {
                [pscustomobject]@{
                    Timestamp    = [datetime]"$($Matches['Date']) $($Matches['Time'])"
                    Size         = $Matches['Size']
                    SourceIp     = $Matches['SourceIp']
                    ForwardedFor = $Matches['ForwardedFor']
                    Method       = $Matches['Method']
                    Path         = $Matches['Path']
                    Code         = $Matches['Code']
                    BeginResult  = $Matches['BeginResult']
                    EndResult    = $Matches['EndResult']
                    Duration     = $Matches['Duration']
                    Protocol     = $Matches['Protocol']
                }
            }
        }
    }
}