title: Multiple strings search in consecutive lines in a log file
body: <p>I have a log file <strong>Input.log</strong> which records failed and successful login attempts made by different users and it keeps updating in real time. I am interested only in failed login attempt made by one user i.e. <strong>master</strong>. Whenever there is a failed login attempt by user <strong>master</strong>, following 3 fixed text strings will always come in 3 consecutive lines as shown below in sample <strong>Input.log</strong> file:</p>
  <pre><code>Authenticating the user &quot;master&quot; with the password
  Failed to logon to the system due to something unexpected
  SSCMPE-00102: Failed to authenticate user. Invalid credentials. Enter valid credentials
  </code></pre>
  <p><strong>Input.log</strong> file sample for a failed login attempt by <strong>master</strong>:</p>
  <pre><code>[2021-05-14T04:18:41.378-06:00] [FoundationServices0] [NOTIFICATION] [01216] [oracle.bi.bifndnepm.bpmui.logon.CSSAuthenticate] [tid: 30] [userId: &lt;anonymous&gt;] [ecid: 00j8DrPuyNGB1FwDwFj8CW0001hC0004FL,0:1] [APP: WORKSPACE#11.1.2.0] [SRC_CLASS: com.hyperion.bpm.logon.CSSAuthenticate] [SRC_METHOD: authenticateUser:473] Authenticating the user &quot;master&quot; with the password &quot;*********&quot;.
  [2021-05-14T04:18:41.573-06:00] [FoundationServices0] [ERROR] [02601] [oracle.bi.bifndnepm.bpmui.logon.LogonServlet] [tid: 30] [userId: &lt;anonymous&gt;] [ecid: 00j8DrPuyNGB1FwDwFj8CW0001hC0004FL,0:1] [APP: WORKSPACE#11.1.2.0] [SRC_CLASS: com.hyperion.bpm.logon.LogonServlet] [SRC_METHOD: writeLogonCssException:206] Failed to logon to the system due to something unexpected.[[
  SSCMPE-00102: Failed to authenticate user. Invalid credentials. Enter valid credentials.
      at com.hyperion.css.store.identity.IdentityStoreImpl.authenticate(IdentityStoreImpl.java:1845)
      at com.hyperion.css.spi.impl.nvdb.NativeProvider.authenticate(NativeProvider.java:74)
      at com.hyperion.css.facade.impl.CSSAbstractAuthenticator.authenticateUser(CSSAbstractAuthenticator.java:645)
      at com.hyperion.css.facade.impl.CSSAPIAuthenticationImpl.authenticate(CSSAPIAuthenticationImpl.java:69)
  </code></pre>
  <p>I want to create a monitoring script sothat as soon as we have these 3 text strings appeared in 3 consecutive lines, I should get an email alert about the failed login attempt made by user <strong>master</strong>.</p>
  <p>I will schedule the script to run in Windows task scheduler. I'd like to make the script run continuously to detect the failed login attempts in real time. So it should read only freshly written entries in <strong>Input.log</strong> file from the previous run of the script.</p>
  <p>So far I have below code that, in <strong>failed.log</strong>, gives me all the lines matching above three strings coming consecutively in three lines (what I actually want) but also many other unwanted lines matching the three strings individually in different lines (which I don't want).</p>
  <pre><code>$File = &quot;C:\data\Input.log&quot;
  
  $EmailParam=@{
      To='usergroup@domain.com'
      From='user@domain.com'
      SmtpServer='smtp.serveraddress.com'
      Subject='Failed Login Attempt by the user Master'
      Body='Alert! Failed Login Attempt found for the user Master'
      Attachment='failed.log'
  }
  
  $String='Authenticating the user &quot;master&quot; with the password','Failed to logon to the system due to something unexpected','SSCMPE-00102: Failed to authenticate user. Invalid credentials. Enter valid credentials'
  
  Get-Content $File | Select-string -Pattern $String | Set-Content failed.log | ForEach {
      Send-MailMessage @EmailParam
  }
  </code></pre>
  <p>Would appreciate if you could guide me to fix it. Thanks!</p>