PowerShell regular expression on logfile is capturing too much - regex

Question

I am trying to extract some text from a logfile, and I'm having problems.
Example text I am working on is:
ahksjhadjsadhsah
sakdsjakdjks
ksajdksaj
REF=35464
sadsad
213213
213
2
13
I need to extract the value "35464" (the REF number). I have limited knowledge of regular expressions, but thought 'REF=([0-9]+)' would do this.
Now I'm not sure how best I should be doing reading this file, so I've tried a couple of ways:
select-string -path e:\powershell\log.txt -pattern 'REF=([0-9]+)' | % { $_.Matches } | % { $_.Value }
Which gives me "REF=35464" - which I don't understand (why REF= is included), because I thought the 'capture' was only the parts in ()'s?
I also tried:
$data=Get-Content e:\powershell\log.txt
$data -match 'REF=([0-9]+)'
$Matches
But $Matches is empty.
I also tried a similar method to the above, but line by line, for example:
foreach ($line in $data)
{
$line -match 'REF=([0-9]+)'
}
I either get no matches or the full match (including the REF= part). I've also tried groups (that is, '(REF=)([0-9]+)'), and I can't get what I need.
How should I be reading the file? What is wrong with my regular expression?
I just need this extracted value as a usable variable.

Answer 1

It may be the way you are trying to access the capture group
I put this quick static class together to illustrate how to get the match you are looking for.
Note: I am using the # symbol on the regex and your input string to make them literals.
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Text.RegularExpressions;
using System.Threading.Tasks;
namespace SkunkWorks.RegexPractice
{
public static class RegexPractice2
{
public static string input = #"ahksjhadjsadhsah
sakdsjakdjks
ksajdksaj
REF=35464
sadsad
213213
213
2
13";
static string pat = #"REF=([0-9]+)";
public static void Do()
{
Regex r = new Regex(pat, RegexOptions.IgnoreCase);
Match m = r.Match(input);
int matchCount = 0;
while (m.Success)
{
Console.WriteLine("Match" + (++matchCount));
for (int i = 1; i <= 2; i++)
{
Group g = m.Groups[i];
Console.WriteLine("Group" + i + "='" + g + "'");
CaptureCollection cc = g.Captures;
for (int j = 0; j < cc.Count; j++)
{
Capture c = cc[j];
System.Console.WriteLine("Capture" + j + "='" + c + "', Position=" + c.Index);
}
}
m = m.NextMatch();
}
}
}
}

Answer 2

What I usually do when I need to extract a substring from an array of strings is to use the automatic variable $Matches that is generated from using the -match operator in a Where statement. Like this:
$Data | Where{$_ -match "REF=([0-9]+)"} | ForEach{$Matches[1]}
Now, the $Matches variable there will be an array. The first entry will be the entire line that it matched, and the second object will be just the captured text, that is why I specify [1]. Now, about your RegEx that you're matching on... technically it's acceptable, but it's not very specific, so it really could return just the first number since [0-9]+ means 1 or more character that falls within the [0-9] scope. If you want to be sure that you get all of the numbers you can tell it to get everything to the end of the line by using the end-of-line character $ in your match like: REF=([0-9]+)$. We can't really tell if there's any whitespace after the numbers, so you might want to allow for that too using the \s notation that looks for any whitespace character (spaces, tabs, whatever), and using the asterisks after it which means zero or more. Then it becomes REF=([0-9]+)\s*$, which gets you exactly what you were looking for. Lastly, I would use \d instead of [0-9] because it does the same thing and it's shorter and simpler, and specifically made for the job. So, we have:
$Data | Where{$_ -match "REF=(\d+)\s*$"} | ForEach{$Matches[1]}
And that is broken down step by step and explained here: https://regex101.com/r/dG7jC7/1