2

Been trying to figure this one out for a while now. Went through this site and googled like crazy. It would be greatly appreciated if someone could help.

I have some log files with no headers and columns are all over the place. Meaning that an item like src=4.2.2.2 could be anywhere in the file. All objects in the file do have a something=xxx format.

Example Log:

src=1.1.1.1 sport=12312 dport=80 message=hacked

dport=443 src=2.2.2.2 message=null sport=32432

message=clean dport=21 sport=43434 src=3.3.3.3

I have used the match() function, but am trying to pull out multiple fields.

gawk 'match($0, "src=([^ ]+)") { print substr($0, RSTART, RLENGTH) } ' file

gives me the following:

src=1.1.1.1

src=2.2.2.2

src=3.3.3.3

I would like to have multiple fields like src, dport and message so the output lines up and looks like the following:

src=1.1.1.1 dport=80 message=hacked

src=2.2.2.2 dport=443 message=null

src=3.3.3.3 dport=21 message=clean

Is this possible with gawk or something else?

Thanks!

  • 1
    So basically you want to take a list with four fields in random order, remove/ignore one of them (sport) and output the other three in a predefined order (src, dport, message). Correct? – nohillside Jan 3 '18 at 15:24
1

Awk solution (independent of item positions):

awk 'function get_item(name){ 
         match($0, name"=[^[:space:]]+"); 
         return substr($0, RSTART, RLENGTH) 
     }
     { print get_item("src"), get_item("dport"), get_item("message") }' file

With the above approach you are able to output the crucial needed items in any order.

The output:

src=1.1.1.1 dport=80 message=hacked
src=2.2.2.2 dport=443 message=null
src=3.3.3.3 dport=21 message=clean
  • 1
    Elegant extension of the OP's methodology - I like it – steeldriver Jan 3 '18 at 16:06
  • That's awesome. Should have just asked in here first. – mrusenet Jan 3 '18 at 17:08
  • Another quick question. How would I include spaces in output? Like if "message=something something something" – mrusenet Jan 3 '18 at 17:09
  • @mrusenet, "Another quick question" does not mean "quick solution". That's another story for another case, not the current one – RomanPerekhrest Jan 3 '18 at 18:19
  • @RomanPerekhrest, thanks for the help. I'll keep at it. Much appreciated. – mrusenet Jan 3 '18 at 21:04
2

With GNU awk (NOTE: this relies on the lexical sort order of the "key" strings):

gawk '{split($0,a); asort(a); printf("%s\t%s\t%s\n", a[4], a[1], a[2])}' file
src=1.1.1.1     dport=80        message=hacked
src=2.2.2.2     dport=443       message=null
src=3.3.3.3     dport=21        message=clean

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.