在 AWK 模式中添加当前日期和时间与通配符匹配
Adding Current Date and Time in AWK pattern match with Wildcard
我有这个要搜索的日志字符串:
[Nov 18, 2019 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003
我想捕获年月日和字符串“RMI Server started”
我在 AIX 命令行中运气不好:
$awk '[=11=] ~ /(date "+%b %d, %Y")*RMI Server started/' /lsf10/law/system/pfrmi.log
注意:它确实捕获了 RMI 服务器启动 - 但此消息的所有日期
第一个问题是 date
调用,虽然从 awk
脚本中调用是可行的,但如果我们在 ksh
中调用并存储结果会更容易在 ksh
变量中,然后使用 -v
选项将此变量传递给 awk
。
第二个问题是将 (awk
) 变量和正则表达式混合用于模式匹配;我发现首先构建正则表达式模式然后使用所述模式进行实际模式匹配要容易一些。
但首先是一些数据……假设 'today' 是 2021 年 3 月 23 日:
$ cat pfrmi.log
[Mar 9, 2019 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - skip this line
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - pick this line
[Nov 18, 2019 8:53:36 AM] some other TOT Server started at: 10.155.166.24:16003 - skip this line
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - pick this line
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - skip this line
[Nov 18, 2020 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - skip this line
现在建议代码:
$ today=$(date '+%b %d, %Y')
$ echo "${today}"
Mar 23, 2021
$ awk -v today="${today}" ' # pass ksh variable into awk
BEGIN { ptn="^[[]"today" .*RMI Server started" } # build our regex pattern
[=11=] ~ ptn # test current line against our regex and if it matches the line will be passed to stdout
' pfrmi.log
对于我的样本数据文件,这会生成:
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - pick this line
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - pick this line
将 awk
折叠成单行命令并删除注释:
awk -v today="${today}" 'BEGIN { ptn="^[[]"today" .*RMI Server started" } [=13=] ~ ptn' pfrmi.log
我有这个要搜索的日志字符串:
[Nov 18, 2019 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003
我想捕获年月日和字符串“RMI Server started”
我在 AIX 命令行中运气不好:
$awk '[=11=] ~ /(date "+%b %d, %Y")*RMI Server started/' /lsf10/law/system/pfrmi.log
注意:它确实捕获了 RMI 服务器启动 - 但此消息的所有日期
第一个问题是 date
调用,虽然从 awk
脚本中调用是可行的,但如果我们在 ksh
中调用并存储结果会更容易在 ksh
变量中,然后使用 -v
选项将此变量传递给 awk
。
第二个问题是将 (awk
) 变量和正则表达式混合用于模式匹配;我发现首先构建正则表达式模式然后使用所述模式进行实际模式匹配要容易一些。
但首先是一些数据……假设 'today' 是 2021 年 3 月 23 日:
$ cat pfrmi.log
[Mar 9, 2019 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - skip this line
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - pick this line
[Nov 18, 2019 8:53:36 AM] some other TOT Server started at: 10.155.166.24:16003 - skip this line
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - pick this line
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - skip this line
[Nov 18, 2020 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - skip this line
现在建议代码:
$ today=$(date '+%b %d, %Y')
$ echo "${today}"
Mar 23, 2021
$ awk -v today="${today}" ' # pass ksh variable into awk
BEGIN { ptn="^[[]"today" .*RMI Server started" } # build our regex pattern
[=11=] ~ ptn # test current line against our regex and if it matches the line will be passed to stdout
' pfrmi.log
对于我的样本数据文件,这会生成:
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - pick this line
[Mar 23, 2021 8:53:36 AM] ProcessFlow RMI Server started at: 10.155.166.24:16003 - pick this line
将 awk
折叠成单行命令并删除注释:
awk -v today="${today}" 'BEGIN { ptn="^[[]"today" .*RMI Server started" } [=13=] ~ ptn' pfrmi.log