We work with log files that have line entries that start with a date/time format such as this:

20150408 13:29:28 <rest of text>

What would I need to do in order to grep for a date range?

Say like all lines that start at 20150408 13:29:28 and end at 20150408 17:55:02?

Would grep be the tool for the job or would something else be better like sed?

  • 1
    I suspect that regexp will not be the best tool (so no grep or sed), though you could do the example. awk may be better. – ctrl-alt-delor Apr 9 '15 at 12:52

Certanly task can be done by sed

sed '/20150408 13:29:28/,/20150408 17:55:02/! d' log_files

but if lines did not have exact 20150408 13:29:28 script will print nothing and if its did not have exact 20150408 17:55:02 file will print every lines till the end. So the better is use date compare by script:

limit1=$(date -d "20150408 13:29:28" +"%s")
limit2=$(date -d "20150408 17:55:02" +"%s")
while read -r logdate logtime logline
    logsec=$(date -d "$logdate $logtime" +"%s")
    if [ $limit1 -le $logsec -a $limit2 -ge $logsec ]
        echo $logdate $logtime $logline
done < log_files
| improve this answer | |
  • A few notes: The posted solution is non-standard in two respects; date's %s and the test operator [ with more than 4 arguments are not defined by POSIX. The pattern match is (as correctly noted) errorprone. (A similar syntax is possible with awk: awk '/from/,/to/', BTW.) Since the OP's date is defined in a regular and sortable way, an awk comparison (as shown in another answer) is straightforward and most legible: awk '$1" "$2 >= from && $1" "$2 <= to' and (IMO) to be preferred. – Janis Apr 9 '15 at 14:08
  • @Janis First thanks to correct my mistype. Second there are not 4 arg's but EXPR1 -a EXPR2 True if both expr1 AND expr2 are true (from help test) – Costas Apr 9 '15 at 14:25
  • No, your test expression (or builtin in some shells; but that doesn't affect the question of POSIX complience) has 7 arguments. (See POSIX: http://pubs.opengroup.org/onlinepubs/9699919799/utilities/test.html.) A POSIX complient version could be if [ $limit1 -le $logsec ] && [ $limit2 -ge $logsec ]; i.e. splitting the one test command in two with three argument each. – Janis Apr 9 '15 at 15:55

I think awk could help:

awk 'BEGIN { sd = "20150408T13:29:28"; ed = "20150408T17:55:02"; } $1 "T" $2 >= sd && $1 "T" $2 <= ed' log
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.