5

We work with log files that have line entries that start with a date/time format such as this:

20150408 13:29:28 <rest of text>

What would I need to do in order to grep for a date range?

Say like all lines that start at 20150408 13:29:28 and end at 20150408 17:55:02?

Would grep be the tool for the job or would something else be better like sed?

Improve this question
1
  • 1
    I suspect that regexp will not be the best tool (so no grep or sed), though you could do the example. awk may be better.
    – ctrl-alt-delor
    Commented Apr 9, 2015 at 12:52

2 Answers 2

Reset to default
4

Certanly task can be done by sed

sed '/20150408 13:29:28/,/20150408 17:55:02/! d' log_files

but if lines did not have exact 20150408 13:29:28 script will print nothing and if its did not have exact 20150408 17:55:02 file will print every lines till the end. So the better is use date compare by script:

limit1=$(date -d "20150408 13:29:28" +"%s")
limit2=$(date -d "20150408 17:55:02" +"%s")
while read -r logdate logtime logline
do
    logsec=$(date -d "$logdate $logtime" +"%s")
    if [ $limit1 -le $logsec -a $limit2 -ge $logsec ]
    then
        echo $logdate $logtime $logline
    fi
done < log_files
Improve this answer
3
  • A few notes: The posted solution is non-standard in two respects; date's %s and the test operator [ with more than 4 arguments are not defined by POSIX. The pattern match is (as correctly noted) errorprone. (A similar syntax is possible with awk: awk '/from/,/to/', BTW.) Since the OP's date is defined in a regular and sortable way, an awk comparison (as shown in another answer) is straightforward and most legible: awk '$1" "$2 >= from && $1" "$2 <= to' and (IMO) to be preferred.
    – Janis
    Commented Apr 9, 2015 at 14:08
  • @Janis First thanks to correct my mistype. Second there are not 4 arg's but EXPR1 -a EXPR2 True if both expr1 AND expr2 are true (from help test)
    – Costas
    Commented Apr 9, 2015 at 14:25
  • No, your test expression (or builtin in some shells; but that doesn't affect the question of POSIX complience) has 7 arguments. (See POSIX: http://pubs.opengroup.org/onlinepubs/9699919799/utilities/test.html.) A POSIX complient version could be if [ $limit1 -le $logsec ] && [ $limit2 -ge $logsec ]; i.e. splitting the one test command in two with three argument each.
    – Janis
    Commented Apr 9, 2015 at 15:55
3

I think awk could help:

awk 'BEGIN { sd = "20150408T13:29:28"; ed = "20150408T17:55:02"; } $1 "T" $2 >= sd && $1 "T" $2 <= ed' log
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .