shell 脚本 +匹配日志文件中的错误词

发布于 01-01 00:09 字数 219 浏览 2 评论 0原文

请建议如何匹配仅出现在“]”字符之后的错误字符串 通过 awk 或 sed

   [Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found 

我的目标是统计日志文件中仅出现在“]”字符之后的所有 ERROR 单词备注

- “]”和 ERROR 之间必须是一个或多个空格

please advice how to match the ERROR strings that comes only after "]" char
by awk or sed

   [Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found 

My target is to count all ERROR words that appears only after "]” character in the log file

remark - between “]” and ERROR must be one space or more

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(5

暗恋未遂2025-01-08 00:09:35

我的目标是统计仅出现在“]”之后的所有错误单词
日志文件中的字符

备注-“]”和ERROR之间必须有一个或多个空格

,这样你就不需要像 awk、sed 甚至 perl 这样的核头了。 grep 为你做这样的事情:

 grep -Pc ']\s+ERROR' yourLogFile

小测试:

kent$  echo "[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found "|grep -Pc ']\s+ERROR'
1

My target is to count all ERROR words that appears only after "]”
character in the log file

remark - between “]” and ERROR must be one space or more

then you don't need those nuclear heads like awk, sed even perl. grep does it for you like this:

 grep -Pc ']\s+ERROR' yourLogFile

small test:

kent$  echo "[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found "|grep -Pc ']\s+ERROR'
1
滿滿的愛2025-01-08 00:09:35

AWK:

awk -F"] " '/ERROR/{print $2}' inputfile

测试:

[jaypal:~] echo "[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found " | awk -F"] " '/ERROR/{print $2}'
ERROR file /etc/ghy.txt not found 

Perl:

perl -pe 's/.*(?<=] )(.*)/$1/' inputfile

测试:

echo "[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found " | perl -pe 's/.*(?<=] )(.*)/$1/'
ERROR file /etc/ghy.txt not found 

计数编号。出现次数:

[jaypal:~/Temp] cat file
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found

[jaypal:~/Temp] awk -F"] " '/ERROR/{a[NR]=$2}END{print "count is " length(a)}' file
count is 9

AWK:

awk -F"] " '/ERROR/{print $2}' inputfile

Test:

[jaypal:~] echo "[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found " | awk -F"] " '/ERROR/{print $2}'
ERROR file /etc/ghy.txt not found 

Perl:

perl -pe 's/.*(?<=] )(.*)/$1/' inputfile

Test:

echo "[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found " | perl -pe 's/.*(?<=] )(.*)/$1/'
ERROR file /etc/ghy.txt not found 

Count no. of occurrences:

[jaypal:~/Temp] cat file
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found
[Mon Jan 30 21:14:01 IST 2012] ERROR file /etc/ghy.txt not found

[jaypal:~/Temp] awk -F"] " '/ERROR/{a[NR]=$2}END{print "count is " length(a)}' file
count is 9
聽兲甴掵2025-01-08 00:09:35

这可能对你有用:

grep -c '\] \+ERROR' file

或者

grep -c '\][[:space:]]\+ERROR' file

或者

sed '/\]\s\+ERROR/!d' file | wc -l

This might work for you:

grep -c '\] \+ERROR' file

Or

grep -c '\][[:space:]]\+ERROR' file

Or

sed '/\]\s\+ERROR/!d' file | wc -l
愁以何悠2025-01-08 00:09:35

这是一个仅 shell 的代码片段,它应该比使用任何外部程序(用于小文件读取)更快,因为它只使用 shell 内置程序。可以对其进行修改,以在守护进程模式下运行时逐个处理错误(通过将日志文件尾部到 fifo,而不是直接读取它并修改 case 条件),

这不是 echo 的预期用途,但它确实将空格/制表符减少到 1 个空格

FILE="logfile"
ERRORS=0
while read LINE || [ "$LINE" ]; do
    case "`echo $LINE`" in
        *\]" "ERROR*)ERRORS=$(($ERRORS+1));;
    esac
done < "${FILE}"
echo $ERRORS

Here is a shell only snippet, that should be faster than using any external programs (for small file reads) since it only uses shell builtins. It can be modified to handle errors case by case while running in a daemon mode (by tail-ing the log file to a fifo instead of reading it directly and modifying the case conditionals)

not the intended use of echo, but it does reduce spaces/tabs to 1 space

FILE="logfile"
ERRORS=0
while read LINE || [ "$LINE" ]; do
    case "`echo $LINE`" in
        *\]" "ERROR*)ERRORS=$(($ERRORS+1));;
    esac
done < "${FILE}"
echo $ERRORS
亽野灬性zι浪2025-01-08 00:09:35

你可以做

sed -n '/] ERROR/p' infile

You can do

sed -n '/] ERROR/p' infile
~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文