Get the content of the WindowsUpdate log as an object

I wanted to read the WindowsUpdate.log created by the Get-WindowsUpdateLog cmdlet. I knew there is an article that shows How to read the Windowsupdate.log file that I used some years ago to color the windows update log.

I also noticed that there’s a major difference in the content of the log.
The column separator is not longer a tab, it’s a serie of spaces.

I’ve also discovered another very insightful article about Understanding the Windowsupdate.log file for advanced users

I created another function that uses regular expression grouping to split each line and extracts the info based on the given format:

	Function Import-WindowsUpdateLog {
	<#
	.SYNOPSIS
	Read the content of the Windows Update log and import it as an object
	.DESCRIPTION
	Read the content of the Windows Update log and import it as an object.
	It will read each line and create an object with the following properties:
	Date,Hour,PID,TID,Component,Message
	.PARAMETER FilePath
	The path of the windows update log file.
	.EXAMPLE
	Import-WindowsUpdateLog -FilePath ~\Desktop\WindowsUpdate.log
	.EXAMPLE
	"~\Desktop\WindowsUpdate.log" | Import-WindowsUpdateLog | Out-GridView
	.EXAMPLE
	Get-Item ~\Desktop\WindowsUpdate.log | Import-WindowsUpdateLog | Out-GridView
	#>
	[CmdletBinding()]
	Param(
	[Parameter(Mandatory,ValueFromPipeline,ValueFromPipelineByPropertyName)]
	[Alias('Path','PSPath')]
	[ValidateScript({
	Test-Path -Path $_ -PathType Leaf
	})]
	[string]$FilePath
	)
	Begin {}
	Process {
	try {
	Get-Content -Path $FilePath -ReadCount 1 -ErrorAction Stop |
	ForEach-Object {
	$Date,$Hour,$WUPID,$WUTID,$Component,$Message = (
	[regex]'^(?<Date>2\d{3}/\d{2}/\d{2})\s+(?<Hour>\d{2}:\d{2}:\d{2}\.\d{1,23})\s+(?<PID>\d{1,6})\s+(?<TID>\d{1,6})\s+(?<Component>[a-zA-Z]+)\s+(?<Message>.+)'
	).Match($_).Groups | Select-Object -Last 6 -ExpandProperty Value
	[PsCustomObject]@{
	Date = $Date
	Hour = $Hour
	PID = $WUPID
	TID = $WUTID
	Component = $Component
	Message = $Message
	}
	}
	} catch {
	Throw "Failed because $($_.Exception.Message)"
	}
	}
	End {}
	}

view raw Import-WULog.ps1 hosted with ❤ by GitHub

With this function, you can simply do:

"~\Desktop\WindowsUpdate.log" | Import-WindowsUpdateLog | 
Out-GridView

and you can use the Out-GridView cmdlet to filter and search what you’re looking for:

The above function is quite handy and would for sure replace notepad to read the human readable WindowsUpdate log file created by the Get-WindowsUpdateLog cmdlet.