Function parseWindowsEventText

host/log_windows.go:166–203

(out string)

}

func parseWindowsEventText(out string) []windowsEvent {
	var blocks []string
	var current []string
	for _, line := range strings.Split(out, "\n") {
		line = strings.TrimRight(line, "\r")
		if strings.HasPrefix(line, "Event[") && strings.HasSuffix(line, "]:") {
			if len(current) > 0 {
				blocks = append(blocks, strings.TrimSpace(strings.Join(current, "\n")))
			}
			current = []string{line}
			continue
		}
		if len(current) > 0 {
			current = append(current, line)
		}
	}
	if len(current) > 0 {
		blocks = append(blocks, strings.TrimSpace(strings.Join(current, "\n")))
	}

	events := make([]windowsEvent, 0, len(blocks))
	for _, block := range blocks {
		e := windowsEvent{Text: block}
		for _, line := range strings.Split(block, "\n") {
			line = strings.TrimSpace(line)
			if !strings.HasPrefix(line, "Event Record ID:") {
				continue
			}
			id, err := strconv.ParseUint(strings.TrimSpace(strings.TrimPrefix(line, "Event Record ID:")), 10, 64)
			if err == nil {
				e.RecordID = id
			}
			break
		}
		events = append(events, e)
	}
	return events
}