Handle unknown IIS log fields on expansion

IISParser.PowerShell/CmdletGetIISParsedLog.cs

@@ -136,19 +136,21 @@ protected override Task ProcessRecordAsync() {
         return Task.CompletedTask;
     }
 
-    private void WriteEvent(IISLogEvent evt) {
-        if (Expand) {
-            var psObj = PSObject.AsPSObject(evt);
-            foreach (var kv in evt.Fields) {
-                if (psObj.Properties[kv.Key] == null) {
-                    psObj.Properties.Add(new PSNoteProperty(kv.Key, kv.Value));
-                }
-            }
-            WriteObject(psObj);
-        } else {
-            WriteObject(evt);
-        }
-    }
+    private void WriteEvent(IISLogEvent evt) {
+        if (Expand) {
+            var psObj = new PSObject();
+            foreach (var prop in PSObject.AsPSObject(evt).Properties) {
+                if (!prop.Name.Equals("Fields", StringComparison.OrdinalIgnoreCase)) {
+                    psObj.Properties.Add(new PSNoteProperty(prop.Name, prop.Value));
+                }
+            }
+            foreach (var kv in evt.Fields)
+                psObj.Properties.Add(new PSNoteProperty(kv.Key, kv.Value));
+            WriteObject(psObj);
+        } else {
+            WriteObject(evt);
+        }
+    }
 
     /// <inheritdoc />
     protected override Task EndProcessingAsync() {

IISParser.Tests/ParserEngineTests.cs

@@ -18,6 +18,15 @@ public void ParseLog_ReturnsEvents() {
         Assert.Equal("192.168.0.1", evt.Fields["X-Forwarded-For"]);
     }
 
+    [Fact]
+    public void ParseLog_RemovesKnownFieldsFromDictionary() {
+        var path = Path.Combine(AppContext.BaseDirectory, "TestData", "sample.log");
+        var engine = new ParserEngine(path);
+        var evt = engine.ParseLog().Single();
+        Assert.False(evt.Fields.ContainsKey("cs-uri-stem"));
+        Assert.False(evt.Fields.ContainsKey("date"));
+    }
+
     [Fact]
     public void ParseLog_HandlesValuesAboveIntMax() {
         var path = Path.Combine(AppContext.BaseDirectory, "TestData", "large_values.log");

IISParser/ParserEngine.cs

@@ -12,6 +12,31 @@ public class ParserEngine : IDisposable {
     private readonly Dictionary<string, string?> _dataStruct = new(StringComparer.OrdinalIgnoreCase);
     private readonly int _mbSize;
 
+    private static readonly HashSet<string> KnownFields = new(StringComparer.OrdinalIgnoreCase) {
+        "date",
+        "time",
+        "s-sitename",
+        "s-computername",
+        "s-ip",
+        "cs-method",
+        "cs-uri-stem",
+        "cs-uri-query",
+        "s-port",
+        "cs-username",
+        "c-ip",
+        "cs-version",
+        "cs(User-Agent)",
+        "cs(Cookie)",
+        "cs(Referer)",
+        "cs-host",
+        "sc-status",
+        "sc-substatus",
+        "sc-win32-status",
+        "sc-bytes",
+        "cs-bytes",
+        "time-taken"
+    };
+
     /// <summary>
     /// Gets the path to the log file being processed.
     /// </summary>
@@ -85,8 +110,10 @@ private void ProcessLine(string line, List<IISLogEvent> events) {
 
     private IISLogEvent NewEventObj() {
         var evt = new IISLogEvent();
-        foreach (var kv in _dataStruct)
-            evt.Fields[kv.Key] = kv.Value;
+        foreach (var kv in _dataStruct) {
+            if (!KnownFields.Contains(kv.Key))
+                evt.Fields[kv.Key] = kv.Value;
+        }
         evt.DateTimeEvent = GetEventDateTime();
         evt.sSitename = GetValue("s-sitename");
         evt.sComputername = GetValue("s-computername");

Module/Tests/Get-IISParsedLog.Tests.ps1

@@ -12,6 +12,7 @@ Describe 'Get-IISParsedLog' {
         $logPath = (Resolve-Path "$PSScriptRoot/../../IISParser.Tests/TestData/sample.log").Path
         $result = Get-IISParsedLog -FilePath $logPath -Expand
         $result.'X-Forwarded-For' | Should -Be '192.168.0.1'
+        ($result.PSObject.Properties.Match('Fields').Count) | Should -Be 0
     }
 
     It 'streams large log with Skip, First and Last' {