public override void Parse()
{
while (!_fileReader.EndOfStream)
{
string line = _fileReader.ReadLine();
if (!isComment(line))
{
CsvEventLogRecord eventLogRecord = CsvEventLogRecord.Fetch(line);
eventLogRecord.ContainingFile = this;
_records.Add(eventLogRecord);
}
}
_fileReader.Close();
}
public static CsvEventLogRecord Fetch(string csvLine)
{
List <string> fields = new List <string>();
string[] rawFields = csvLine.Split(',');
for (int i = 0; i < rawFields.Length; i++)
{
StringBuilder fieldContent = new StringBuilder(rawFields[i]);
if (rawFields[i].StartsWith("\""))
{
if (!rawFields[i].EndsWith("\""))
{
do
{
i++;
fieldContent.Append(rawFields[i]);
} while (!rawFields[i].Trim().EndsWith("\""));
}
}
fields.Add(fieldContent.ToString());
}
for (int i = 0; i < fields.Count; i++)
{
fields[i] = fields[i].Replace("<NL>", "\n");
}
//ComputerName, [Logfile], [CategoryString], Type, User, [EventCode], SourceName, EventIdentifier, Message, [RecordNumber], TimeGenerated
CsvEventLogRecord eventLogRecord = new CsvEventLogRecord();
eventLogRecord._computer = fields[COMPUTER_NAME];
eventLogRecord._type =
getEventLogEntryType(fields[EVENT_LOG_TYPE]);
eventLogRecord._user = fields[USER];
eventLogRecord._source = fields[SOURCE];
eventLogRecord._eventId = Int32.Parse(fields[EVENT_ID]);
eventLogRecord._message = fields[MESSAGE];
eventLogRecord._generatedTime = parseDateTime(fields[GENERATED_TIME]);
return(eventLogRecord);
}
public static CsvEventLogRecord Fetch(string csvLine)
{
List<string> fields = new List<string>();
string[] rawFields = csvLine.Split(',');
for (int i = 0; i < rawFields.Length; i++)
{
StringBuilder fieldContent = new StringBuilder(rawFields[i]);
if (rawFields[i].StartsWith("\""))
{
if (!rawFields[i].EndsWith("\""))
{
do
{
i++;
fieldContent.Append(rawFields[i]);
} while (!rawFields[i].Trim().EndsWith("\""));
}
}
fields.Add(fieldContent.ToString());
}
for (int i = 0; i < fields.Count; i++)
{
fields[i] = fields[i].Replace("<NL>", "\n");
}
//ComputerName, [Logfile], [CategoryString], Type, User, [EventCode], SourceName, EventIdentifier, Message, [RecordNumber], TimeGenerated
CsvEventLogRecord eventLogRecord = new CsvEventLogRecord();
eventLogRecord._computer = fields[COMPUTER_NAME];
eventLogRecord._type =
getEventLogEntryType(fields[EVENT_LOG_TYPE]);
eventLogRecord._user = fields[USER];
eventLogRecord._source = fields[SOURCE];
eventLogRecord._eventId = Int32.Parse(fields[EVENT_ID]);
eventLogRecord._message = fields[MESSAGE];
eventLogRecord._generatedTime = parseDateTime(fields[GENERATED_TIME]);
return eventLogRecord;
}