Imagine sitting by a campfire, watching the flames dance and crackle. Meanwhile, you don’t want to leave because the action is happening in real time. That’s exactly what Get-Content -Wait does for your files in PowerShell. Instead of reading a file once and walking away, you sit by the “fire” of your log or output file, watching every new line appear as it’s written.
If you love event-driven automation, Get-Content -Wait is like having a tiny event listener built right into your console. In fact, it reacts immediately whenever your file changes. PowerShell reacts immediately, no polling, no manual refreshing! It’s the simplest way to turn static logs or output files into a live stream of events that you can filter, transform, or even trigger further actions from.
🎬 By the end of this post, you’ll be able to stream files in real time, filter the content on the fly, and even react automatically to events in your log, all while staying in your console. You’ll also see this icon when it’s time for you get jump into action
📒 We’ll explore the mechanics of -Wait, how it interacts with pipelines, and some clever tricks to combine it with cmdlets like Where-Object and ForEach-Object for reactive, live monitoring workflows.
Lets get started!
Today’s Log Watch Setup
Here’s what we’re packing in our monitoring toolkit:
- Live File Streaming – Watch files as they grow, line by line
- Reactive Filtering – Focus only on what matters with conditional logic
- Automated Actions – Trigger reactions automatically when specific patterns appear
- Console Intelligence – Keep your eyes on the console and let PowerShell do the work
Why Watch Files in Real Time?
Think about it: PowerShell is already great for automation, but what happens when you need to react instantly to new log entries? Or when you want to monitor processes or services without constantly refreshing the file manually?
📒 Under the hood: Get-Content -Wait keeps your file handle open and streams new content as it’s written. It behaves like an event listener, turning a static file into a live feed. You can pipe this directly to cmdlets like Where-Object or ForEach-Object to filter, transform, or trigger reactions on the fly, effectively making your scripts reactive!
Microsoft’s documentation on the CMDLet we’ll be using can be found at:
Getting Your Log Watch Station Ready!
Now it’s time to get our hands dirty! We’re going to turn a file into a live, reactive feed so we can watch it in real time. Follow the steps below to get started!
🎬 Run the script below in a PowerShell session
$logFile = "C:\logs\app.log"
New-Item -Path $logFile -ItemType File -Force | Out-Null
1..5 | ForEach-Object {
Add-Content -Path $logFile -Value "Log entry $_ at $(Get-Date)"
}
Get-Content -Path $logFile -Wait📒 Explanation:
- Get-Content -Path $logFile reads the current content of the file.
- -Wait keeps the file handle open and streams new content as it’s added, so you can see log entries appear live.
- You can combine this with Where-Object or ForEach-Object to filter or trigger actions whenever new lines arrive, essentially turning your log file into an event-driven source for your scripts.
🎬 Try appending a new line while Get-Content -Wait is running (in a new powershell session or just by opening the app.log with notepad)
Add-Content -Path $logFile -Value “Critical ERROR at $(Get-Date)”
You’ll see it appear immediately in the live stream, no refreshing needed!
Cool right!
Filtering the Stream, only See What Matters
Watching every line is fun; however, but often you only care about specific events, like errors, warnings, or special markers. With Get-Content -Wait, you can pipe the live stream through filters to see only the lines that matter.
🎬 Run the script below to filter your live log (stop the current one if you have it open. You can do so by entering ‘CTRL+C’ in the shell), and make a change to the file we are watching with the code.
# Start watching the log file, but only show lines containing "ERROR"
Get-Content -Path $logFile -Wait |
Where-Object { $_ -match "ERROR" }
U see its not appearing right? That is because we are looking to match for something with ‘error’ in there. 🎬 Now lets add a line “ERROR: MANUAL ENTRY” and save the file.
Tadaaaa! 🎉🎉🎉
📒 Explanation:
- Where-Object { $_ -match “ERROR” } filters each line as it appears in real time.
- Only lines that match the condition are displayed, everything else is ignored.
- This effectively turns your log file into a selective event stream, similar to subscribing to only the events you care about in an event-driven system.
🎬 Try appending a few lines to your log while the filtered stream is running:
Taking Action, Reactive Automation!
Now that we’re filtering, why not react automatically? For Example; You can pipe the filtered stream into ForEach-Object to trigger actions, like sending notifications, writing to another file, or updating dashboards.
🎬 Example: create a new file each time an alert for each ERROR
$errorDir = "C:\logs"
if (-not (Test-Path $errorDir)) {
New-Item -Path $errorDir -ItemType Directory | Out-Null
}
Get-Content -Path $logFile -Wait |
Where-Object { $_ -match "ERROR" } |
ForEach-Object {
# Create a file for each error with timestamp in filename
$timestamp = Get-Date -Format "yyyyMMdd_HHmmssfff"
$errorFile = Join-Path $errorDir "Error_$timestamp.txt"
$_ | Out-File -FilePath $errorFile -Encoding UTF8
Write-Host "ALERT: ERROR logged to $errorFile" -ForegroundColor Red
}
We now see this happening:
- The Shell is picking up the change:
- A new file gets created for each time we modify the watched file:
- The file gets the content of what we save in our watched file:
Cool right?!
From this level on you can start thinking about implementations like;
- Implement Azure functions to take certain action
- Implement a mail sent functionality to sent the file as attachment
Summary
In this post, we unlocked a powerful layer of event-driven automation in PowerShell by exploring Get-Content -Wait and turning a static file into a live stream of events 🎉.
We started by showing why real-time monitoring is so useful, and how -Wait acts like a tiny event listener built right into your console ✅. No polling, no manual refreshing! Just reactive streams that react as new content is written to your file.
Next, it was action time:
🎬 You created a sample log file and saw how new lines appear instantly in the console as the file changes.
🎬 Then we filtered the stream with Where-Object so you only see the events that matter, like ERROR lines popping up live.
🎬 Finally, we took it further by automating reactions with ForEach-Object, creating a new file for each ERROR and logging the alerts automatically 🚀.
We saw this workflow in action: the console reacted immediately, new files were generated for each alert, and you now have a foundation to extend into more advanced automations like sending emails, calling APIs, or integrating with Azure Functions 🔒.
Now you’ve got a reactive PowerShell setup that watches files, filters events, and triggers automated actions, all without relying on traditional event subscriptions. Magic ✨.
Hope this helped you level up your PowerShell monitoring and made real-time automation just a little more fun. Keep watching, keep reacting, and as always, have fun doing it! 😎
Oh! And if you are interested in more cool event-driven things, check out my other posts as well: