In this blog post you’ll learn severals ways to use regular expression from within PowerShell. You’ve most likely used some of thesetechniques before. Such as the -match operator or the select-string cmdlet, but probably weren’t aware you were using regular expression.This post will not teach you how to craft complex regular expressions. Instead it focuses on how to use them in PowerShell to find matches, replacetext, and to split on matches.
- Powershell Regex Cheat Sheet
- Powershell Regex Cheat Sheet Pdf
- Regular Expression Powershell
- Powershell Regular Expression Cheat Sheet Pdf
Powershell Regex Cheat Sheet
The -match operator matches a string with regular expression. It returns a true or false statement indicating whether or not a match was found. Then itstores all the matches found in a variable called $matches. A simple example of this is below, I’m matching the word Administrator from a distinguished namefrom Active Directory. This example might not seem like it’s using regular expression because it’s using only literal characters Administrator, but it is.
Let’s make it a little more regex looking by replacing the literal characters Administrator with some regex metacharacters and a subexpression. I’ll use the regexexpression CN=(w+). The C and N are still literal characters matching a capital C and a capital N, but w is a metacharacters that matches any word character. The + sign isanother metacharacters that means to match one or more times. The parenthesis are used to capture the match found by w+, in this example Administrator. The benefitof using metacharacters is it makes the expression more dynamic just like parameters do for functions.
Power Query Custom Functions – Cheat Sheet 2021-01-31 Big List of Cheat sheets and References 2021-01-27 Creating a Discord Webhook in a few lines of PowerShell 2021-01-22.
The -match operator has a few different versions you should be aware of. By default PowerShell is case-insensitive so there is a case-sensitive version of the -matchoperator -cmatch. There are opposites of both of these operators -notmatch and -cnotmatch. I won’t cover all of these variants, but it’s worth taking a look at the-notmatch operator. Sometimes it’s easier to say what you do not want than what you do want. The below example demonstrates this by getting a list of services where the nameof the service does not match a digit.
Powershell Regex Cheat Sheet Pdf
- The following regex seems to do the job of finding the larger strings where I need to make replacements, but I don't know what functionality in Powershell (replace?) to use to just replace the substring of the results. Also, feel free to suggest a better regex if that would help.
- PowerShell is a task based command line shell and scripting language. To run it, click Start, type PowerShell, run PowerShell ISE or PowerShell as Administrator. Commands are written in verb -noun form, and named parameters start with a dash.
Matching text is always the first part of using regular expression and it’s useful, but most of the time you want to do something with that match. Using the same exampleas above I can use the -replace operator instead of -match to replace the entire string with what I wanted to match. The expression looks like this ‘CN=(w+).*’,‘$1’.I’m using a subexpression () to capture the match ‘Administrator’. Matches found within subexpression are stored in variables. In PowerShell they start at the number 0 and incrementby one for each subexpression used. That is why you see the ’$1’ in the expression. If you’re not familiar with -replace the syntax is ‘this’ -replace ‘this’,‘that’ which replacethe word this with that. Relating that to our expression ‘CN=(w+).* matches the entire distinguished name and ’$1’ replaces it with the match found in the first subexpression. Inthis case ‘Administrator’.
Sometimes you don’t want to replace any text from a match but rather simply split it and use both parts to accomplish a given task. That’s where the -split operator can come in handy.I’ll use an example of splitting a users’s UPN into two sections the first will contain the user name and the second will contain the domain name. I’ll use that information to query the userwith Get-ADUser and specify the server name.
Select-String searches for text and text patterns in either a string or a set of files. I use it mostly for looking through scripts I’ve written to identify which scriptscontain keywords I’m looking for. For example I could use it to search a folder for all scripts that are using Active Directory cmdlets with the verbs Get and Set. To do that, Icould craft a simple expression that looks for a few verbs Get and Set followed by -AD then a series of words. That expression might look something like this [GS]et-ADw+.[GS] is a character class, but simply put it means allow G or S as the first character.
Another way to use regex in PowerShell is within a switch statement. In the below example I’m using regular expression to validate user names in Active Directory. There arethree statements one validates service account names, another validates admin accounts and the last one identifies invalid characters. You could perhaps take this logic andadd it to some PowerShell automation that creates user accounts. Each of these switch statements could execute different processes for creating Active Directory accounts.
So far I’ve been using operators, cmdlets and statements that handle regex in an integrated manner. This means it has been hiding much of the regular expression engine from us.I mention this because the regex object, which I’ll cover next is not integrated. It is referred to as procedural and object-oriented. If you have experience with other programinglanguages such as java or C# this will look very familiar, if not don’t worry it’s really not that difficult.
To create the regex object, you create a variable and type cast it to [regex]. The variable contains the regular expression you want to use. I will be using the regex object toextract a domain name from an Active Directory distinguished name. Below has a distinguished name stored in a variable called $DN then I create the regex object and specify theregular expression to use. Breaking down the regular expression, (?:.*?) matches the entire distinguished name. . matches any character and the *** is a quantifier that matches zero or more times.It’s also option because of the ?. What is interesting about the first part of this expression is the ?: it is a non-capturing subexpression. You’ll see what that means in a minute.DC=(.*) is the second half of the expression and matches the literal characters DC= then matches any character zero or more times .*. (.*) is within a capturing subexpression which I’ll uselater to obtain the domain name. Safari download for mac download.
If you ran the above code, you noticed that it didn’t actually do anything nor did it populate the $matches variable. This is because, it’s an object and to interact with objects you use their methods.To take a look at all the methods pipe $rx to get-member $rx | Get-Member. The first method I’ll demonstrate is the match method. The syntax is $rx followed by .match() inside ()is the thing you want to match against. In this case it’s the string variable $dn that contains the distinguished name. Take a look at the below screenshot and notice that there are only 2 captures, $0 and $1.This is because I used non-capturing parenthesis for the first subexpression. You can also quickly identify the domain name for this distinguished name by looking at the contents of $1 wef,DC=com. However, Ihighly doubt management would accept it in this format so let’s move on to the replace method and clean it up.
At this point, I’ve successfully matched the last half of the distinguished name which contains the domain name. However, that is stored within a capture group $1. It also isn’t formatted correctly. It should be wef.com, notwef,DC=com. So I really have two problems to solve. First, replace the entire distinguished name with $1. Secondly, I need to replace ,DC= with . to make wef.com. To accomplish this, I’m using both the regex replace methodand the -replace operator. Below starts by showing the output of just the replace method then combines it with the -replace operator to clean up the formating.
The regex object also has a split method that can be used to, well split text where a regular expression matches. Previously, I’ve been creating regex objects and storing them in variables.You don’t have to do that if you are not going to reuse the expression. Below is an example that takes a URL and split off the HTTP or HTTPS prefix, leaving just the server name and path.
Pluralsight Course
If you want to learn more about regular expression, check out my Pluralsight course titled Introduction to Regular Expression (Regex).
-->A regular expression is a pattern that the regular expression engine attempts to match in input text. A pattern consists of one or more character literals, operators, or constructs. For a brief introduction, see .NET Regular Expressions.
Each section in this quick reference lists a particular category of characters, operators, and constructs that you can use to define regular expressions.
We've also provided this information in two formats that you can download and print for easy reference:
Character Escapes
The backslash character () in a regular expression indicates that the character that follows it either is a special character (as shown in the following table), or should be interpreted literally. For more information, see Character Escapes.
Regular Expression Powershell
| Escaped character | Description | Pattern | Matches |
|---|---|---|---|
a | Matches a bell character, u0007. | a | 'u0007' in 'Error!' + 'u0007' |
b | In a character class, matches a backspace, u0008. | [b]{3,} | 'bbbb' in 'bbbb' |
t | Matches a tab, u0009. | (w+)t | 'item1t', 'item2t' in 'item1titem2t' |
r | Matches a carriage return, u000D. (r is not equivalent to the newline character, n.) | rn(w+) | 'rnThese' in 'rnThese arentwo lines.' |
v | Matches a vertical tab, u000B. | [v]{2,} | 'vvv' in 'vvv' |
f | Matches a form feed, u000C. | [f]{2,} | 'fff' in 'fff' |
n | Matches a new line, u000A. | rn(w+) | 'rnThese' in 'rnThese arentwo lines.' |
e | Matches an escape, u001B. | e | 'x001B' in 'x001B' |
| Uses octal representation to specify a character (nnn consists of two or three digits). | w040w | 'a b', 'c d' in 'a bc d' |
xnn | Uses hexadecimal representation to specify a character (nn consists of exactly two digits). | wx20w | 'a b', 'c d' in 'a bc d' |
cXcx | Matches the ASCII control character that is specified by X or x, where X or x is the letter of the control character. | cC | 'x0003' in 'x0003' (Ctrl-C) |
unnnn | Matches a Unicode character by using hexadecimal representation (exactly four digits, as represented by nnnn). | wu0020w | 'a b', 'c d' in 'a bc d' |
| When followed by a character that is not recognized as an escaped character in this and other tables in this topic, matches that character. For example, * is the same as x2A, and . is the same as x2E. This allows the regular expression engine to disambiguate language elements (such as * or ?) and character literals (represented by * or ?). | d+[+-x*]d+ | '2+2' and '3*9' in '(2+2) * 3*9' |
Character Classes
A character class matches any one of a set of characters. Character classes include the language elements listed in the following table. For more information, see Character Classes.
| Character class | Description | Pattern | Matches |
|---|---|---|---|
[character_group] | Matches any single character in character_group. By default, the match is case-sensitive. | [ae] | 'a' in 'gray''a', 'e' in 'lane' |
[^character_group] | Negation: Matches any single character that is not in character_group. By default, characters in character_group are case-sensitive. | [^aei] | 'r', 'g', 'n' in 'reign' |
[first-last] | Character range: Matches any single character in the range from first to last. | [A-Z] | 'A', 'B' in 'AB123' |
. | Wildcard: Matches any single character except n. To match a literal period character (. or u002E), you must precede it with the escape character (.). | a.e | 'ave' in 'nave''ate' in 'water' |
p{name} | Matches any single character in the Unicode general category or named block specified by name. | p{Lu}p{IsCyrillic} | 'C', 'L' in 'City Lights''Д', 'Ж' in 'ДЖem' |
P{name} | Matches any single character that is not in the Unicode general category or named block specified by name. | P{Lu}P{IsCyrillic} | 'i', 't', 'y' in 'City''e', 'm' in 'ДЖem' |
w | Matches any word character. | w | 'I', 'D', 'A', '1', '3' in 'ID A1.3' |
W | Matches any non-word character. | W | ' ', '.' in 'ID A1.3' |
s | Matches any white-space character. | ws | 'D ' in 'ID A1.3' |
S | Matches any non-white-space character. | sS | ' _' in 'int __ctr' |
d | Matches any decimal digit. | d | '4' in '4 = IV' |
D | Matches any character other than a decimal digit. | D | ' ', '=', ' ', 'I', 'V' in '4 = IV' |
Anchors
Anchors, or atomic zero-width assertions, cause a match to succeed or fail depending on the current position in the string, but they do not cause the engine to advance through the string or consume characters. The metacharacters listed in the following table are anchors. For more information, see Anchors.
| Assertion | Description | Pattern | Matches |
|---|---|---|---|
^ | By default, the match must start at the beginning of the string; in multiline mode, it must start at the beginning of the line. | ^d{3} | '901' in '901-333-' |
$ | By default, the match must occur at the end of the string or before n at the end of the string; in multiline mode, it must occur before the end of the line or before n at the end of the line. | -d{3}$ | '-333' in '-901-333' |
A | The match must occur at the start of the string. | Ad{3} | '901' in '901-333-' |
Z | The match must occur at the end of the string or before n at the end of the string. | -d{3}Z | '-333' in '-901-333' |
z | The match must occur at the end of the string. | -d{3}z | '-333' in '-901-333' |
G | The match must occur at the point where the previous match ended. | G(d) | '(1)', '(3)', '(5)' in '(1)(3)(5)[7](9)' |
b | The match must occur on a boundary between a w (alphanumeric) and a W (nonalphanumeric) character. | bw+sw+b | 'them theme', 'them them' in 'them theme them them' |
B | The match must not occur on a b boundary. | Bendw*b | 'ends', 'ender' in 'end sends endure lender' |
Grouping Constructs
Grouping constructs delineate subexpressions of a regular expression and typically capture substrings of an input string. Grouping constructs include the language elements listed in the following table. For more information, see Grouping Constructs.
| Grouping construct | Description | Pattern | Matches |
|---|---|---|---|
(subexpression) | Captures the matched subexpression and assigns it a one-based ordinal number. | (w)1 | 'ee' in 'deep' |
(?<name>subexpression)or (?'name'subexpression) | Captures the matched subexpression into a named group. | (?<double>w)k<double> | 'ee' in 'deep' |
(?<name1-name2>subexpression)or (?'name1-name2'subexpression) | Defines a balancing group definition. For more information, see the 'Balancing Group Definition' section in Grouping Constructs. | (((?'Open'()[^()]*)+((?'Close-Open'))[^()]*)+)*(?(Open)(?!))$ | '((1-3)*(3-1))' in '3+2^((1-3)*(3-1))' |
(?:subexpression) | Defines a noncapturing group. | Write(?:Line)? | 'WriteLine' in 'Console.WriteLine()''Write' in 'Console.Write(value)' |
(?imnsx-imnsx:subexpression) | Applies or disables the specified options within subexpression. For more information, see Regular Expression Options. | Ad{2}(?i:w+)b | 'A12xl', 'A12XL' in 'A12xl A12XL a12xl' |
(?=subexpression) | Zero-width positive lookahead assertion. | bw+b(?=.+and.+) | 'cats', 'dogs'in 'cats, dogs and some mice.' |
(?!subexpression) | Zero-width negative lookahead assertion. | bw+b(?!.+and.+) | 'and', 'some', 'mice'in 'cats, dogs and some mice.' |
(?<=subexpression) | Zero-width positive lookbehind assertion. | bw+b(?<=.+and.+)——————————— bw+b(?<=.+and.*) | 'some', 'mice'in 'cats, dogs and some mice.'———————————— 'and', 'some', 'mice'in 'cats, dogs and some mice.' |
(?<!subexpression) | Zero-width negative lookbehind assertion. | bw+b(?<!.+and.+)——————————— bw+b(?<!.+and.*) | 'cats', 'dogs', 'and'in 'cats, dogs and some mice.'———————————— 'cats', 'dogs'in 'cats, dogs and some mice.' |
(?>subexpression) | Atomic group. | (?>a|ab)c | 'ac' in'ac'nothing in 'abc' |
Lookarounds at a glance
When the regular expression engine hits a lookaround expression, it takes a substring reaching from the current position to the start (lookbehind) or end (lookahead) of the original string, and then runsRegex.IsMatch on that substring using the lookaround pattern. Success of this subexpression's result is then determined by whether it's a positive or negative assertion.
| Lookaround | Name | Function |
|---|---|---|
(?=check) | Positive Lookahead | Asserts that what immediately follows the current position in the string is 'check' |
(?<=check) | Positive Lookbehind | Asserts that what immediately precedes the current position in the string is 'check' |
(?!check) | Negative Lookahead | Asserts that what immediately follows the current position in the string is not 'check' |
(?<!check) | Negative Lookbehind | Asserts that what immediately precedes the current position in the string is not 'check' |
Once they have matched, atomic groups won't be re-evaluated again, even when the remainder of the pattern fails due to the match. This can significantly improve performance when quantifiers occur within the atomic group or the remainder of the pattern.
Quantifiers
A quantifier specifies how many instances of the previous element (which can be a character, a group, or a character class) must be present in the input string for a match to occur. Quantifiers include the language elements listed in the following table. For more information, see Quantifiers.
| Quantifier | Description | Pattern | Matches |
|---|---|---|---|
* | Matches the previous element zero or more times. | d*.d | '.0', '19.9', '219.9' |
+ | Matches the previous element one or more times. | 'be+' | 'bee' in 'been', 'be' in 'bent' |
? | Matches the previous element zero or one time. | 'rai?n' | 'ran', 'rain' |
{n} | Matches the previous element exactly n times. | ',d{3}' | ',043' in '1,043.6', ',876', ',543', and ',210' in '9,876,543,210' |
{n,} | Matches the previous element at least n times. | 'd{2,}' | '166', '29', '1930' |
{n,m} | Matches the previous element at least n times, but no more than m times. | 'd{3,5}' | '166', '17668''19302' in '193024' |
*? | Matches the previous element zero or more times, but as few times as possible. | d*?.d | '.0', '19.9', '219.9' |
+? | Matches the previous element one or more times, but as few times as possible. | 'be+?' | 'be' in 'been', 'be' in 'bent' |
?? | Matches the previous element zero or one time, but as few times as possible. | 'rai??n' | 'ran', 'rain' |
{n}? | Matches the preceding element exactly n times. | ',d{3}?' | ',043' in '1,043.6', ',876', ',543', and ',210' in '9,876,543,210' |
{n,}? | Matches the previous element at least n times, but as few times as possible. | 'd{2,}?' | '166', '29', '1930' |
{n,m}? | Matches the previous element between n and m times, but as few times as possible. | 'd{3,5}?' | '166', '17668''193', '024' in '193024' |
Backreference Constructs
A backreference allows a previously matched subexpression to be identified subsequently in the same regular expression. The following table lists the backreference constructs supported by regular expressions in .NET. For more information, see Backreference Constructs.
| Backreference construct | Description | Pattern | Matches |
|---|---|---|---|
| Backreference. Matches the value of a numbered subexpression. | (w)1 | 'ee' in 'seek' |
k<name> | Named backreference. Matches the value of a named expression. | (?<char>w)k<char> | 'ee' in 'seek' |
Alternation Constructs
Alternation constructs modify a regular expression to enable either/or matching. These constructs include the language elements listed in the following table. For more information, see Alternation Constructs.
| Alternation construct | Description | Pattern | Matches |
|---|---|---|---|
| | Matches any one element separated by the vertical bar (|) character. | th(e|is|at) | 'the', 'this' in 'this is the day.' |
(?(expression)yes|no) | Matches yes if the regular expression pattern designated by expression matches; otherwise, matches the optional no part. expression is interpreted as a zero-width assertion. | (?(A)Ad{2}b|bd{3}b) | 'A10', '910' in 'A10 C103 910' |
(?(name)yes|no) | Matches yes if name, a named or numbered capturing group, has a match; otherwise, matches the optional no. | (?<quoted>')?(?(quoted).+?'|S+s) | 'Dogs.jpg ', 'Yiska playing.jpg' in 'Dogs.jpg 'Yiska playing.jpg' |
Substitutions
Substitutions are regular expression language elements that are supported in replacement patterns. For more information, see Substitutions. The metacharacters listed in the following table are atomic zero-width assertions.
| Character | Description | Pattern | Replacement pattern | Input string | Result string |
|---|---|---|---|---|---|
$number | Substitutes the substring matched by group number. | b(w+)(s)(w+)b | $3$2$1 | 'one two' | 'two one' |
${name} | Substitutes the substring matched by the named group name. | b(?<word1>w+)(s)(?<word2>w+)b | ${word2} ${word1} | 'one two' | 'two one' |
$$ | Substitutes a literal '$'. | b(d+)s?USD | $$$1 | '103 USD' | '$103' |
$& | Substitutes a copy of the whole match. | $?d*.?d+ | **$&** | '$1.30' | '**$1.30**' |
$` | Substitutes all the text of the input string before the match. | B+ | $` | 'AABBCC' | 'AAAACC' |
$' | Substitutes all the text of the input string after the match. | B+ | $' | 'AABBCC' | 'AACCCC' |
$+ | Substitutes the last group that was captured. | B+(C+) | $+ | 'AABBCCDD' | 'AACCDD' |
$_ | Substitutes the entire input string. | B+ | $_ | 'AABBCC' | 'AAAABBCCCC' |
Powershell Regular Expression Cheat Sheet Pdf
Regular Expression Options
You can specify options that control how the regular expression engine interprets a regular expression pattern. Many of these options can be specified either inline (in the regular expression pattern) or as one or more RegexOptions constants. This quick reference lists only inline options. For more information about inline and RegexOptions options, see the article Regular Expression Options.
You can specify an inline option in two ways:
- By using the miscellaneous construct
(?imnsx-imnsx), where a minus sign (-) before an option or set of options turns those options off. For example,(?i-mn)turns case-insensitive matching (i) on, turns multiline mode (m) off, and turns unnamed group captures (n) off. The option applies to the regular expression pattern from the point at which the option is defined, and is effective either to the end of the pattern or to the point where another construct reverses the option. - By using the grouping construct
(?imnsx-imnsx:subexpression), which defines options for the specified group only.
The .NET regular expression engine supports the following inline options:
| Option | Description | Pattern | Matches |
|---|---|---|---|
i | Use case-insensitive matching. | b(?i)a(?-i)aw+b | 'aardvark', 'aaaAuto' in 'aardvark AAAuto aaaAuto Adam breakfast' |
m | Use multiline mode. ^ and $ match the beginning and end of a line, instead of the beginning and end of a string. | For an example, see the 'Multiline Mode' section in Regular Expression Options. | |
n | Do not capture unnamed groups. | For an example, see the 'Explicit Captures Only' section in Regular Expression Options. | |
s | Use single-line mode. | For an example, see the 'Single-line Mode' section in Regular Expression Options. | |
x | Ignore unescaped white space in the regular expression pattern. | b(?x) d+ s w+ | '1 aardvark', '2 cats' in '1 aardvark 2 cats IV centurions' |
Miscellaneous Constructs
Miscellaneous constructs either modify a regular expression pattern or provide information about it. The following table lists the miscellaneous constructs supported by .NET. For more information, see Miscellaneous Constructs.
| Construct | Definition | Example |
|---|---|---|
(?imnsx-imnsx) | Sets or disables options such as case insensitivity in the middle of a pattern.For more information, see Regular Expression Options. | bA(?i)bw+b matches 'ABA', 'Able' in 'ABA Able Act' |
(?#comment) | Inline comment. The comment ends at the first closing parenthesis. | bA(?#Matches words starting with A)w+b |
# [to end of line] | X-mode comment. The comment starts at an unescaped # and continues to the end of the line. | (?x)bAw+b#Matches words starting with A |
See also