1) We have a process.log file in which we have lot of text data and in between we have some XML data published.
2) There of thousands of different XML published in the logs along with other text data.
3) Now i need to select only the XML files which are published after Outgoing XML: value
4) Also the XML file which must be selected and copied to a new file should be the one which matches the value in the ALERTID tag.
5) The ALERTID value will be provided in the script input. So in our case mGMjhgHgffHhhFdH1u4 will be provided in the input and we need to select the full XML file published for this alertid. Starting tag is from <xml version..> and ending tag is </Alert>
5) So i need to select the relevant Outgoing XML file in a new file based on a particular ALERTID so it can be replayed in different environments.

Format of the log file is like below:

Info Jan 11 17:30:26.12122 The process is not responding to heartbeats
Debug Jan 11 17:30:26.12123  Incoming XML :<xml version "1.0" encoding ="UTF-8"?>
<Alert trigger = "true" >
</Alert> (CreateInitEventHandler. C:356)
Debug Jan 11 17:30:26.12199 The process is going down with warnings
Debug Jan 11 17:30:26.148199 Outgoing XML: <xml version "1.0" encoding ="UTF-8"?>
<Alert trigger = "true" >
</Alert>(CreateEventHandler. C:723)
Debug Jan 11 17:30:26.13214 The process has restarted and thread opened
Debug Jan 11 17:30:26.13215 The heartbeat is recieved from alertlistener process

Now the requirement is to take AlertID in the input, scan the process log and extract the matching outgoing XML in a separate file.

Using awk i am able to extract all the outgoing xml files but not sure how to extract the one related to a particular AlertID.

Also i cannot install/use any new XML parser as per the company policy. This needs to be achieved using shell/perl/awk/sed


awk '/Outgoing/{p=1; s=$0} P & & /<\/Alert>/ {print $0 FS s; s="" ;p=0}p' 1.log>2.log
  • 1
    there's no Outgoing word in your input - extend your input and post the expected result file contents Commented Jan 15, 2018 at 16:34
  • 1
    wasted my time answering, this is a duplicate of unix.stackexchange.com/questions/416658/… Commented Jan 15, 2018 at 17:06
  • Thanks Gerard for answering... Your script works and that's the answer I was looking for.. It wasn't answered in the other thread and was marked as duplicate of some other issue.. So posted again... But thanks a lot Commented Jan 15, 2018 at 20:07

2 Answers 2


Supposing your ID is given in a variable called ALERTID:

sed -e '/Outgoing XML/!d;:a' -e '$d;N;s/.*\(<xml version.*<\/Alert>\).*/\1/;Ta' -e "/$ALERTID/!d" yourfile.log


  • /Outgoing XML/!d;:a delete stuff until the Outgoing XML line and start a loop then
  • $d to delete an unfinished record at the end of the file
  • N;s/.*\(<xml version.*<\/Alert>\).*/\1/;Ta appends lines until the </Alert> tag is found and removes everything before and after the desired block "/$ALERTID/!ddeletes blocks without the$ALERTID`

Maybe better to read:

sed '/Outgoing XML/!d;:a
     s/.*\(<xml version.*<\/Alert>\).*/\1/;Ta
     /'$ALERTID'/!d' yourfile.log
  • Thanks a lot Phillippos... This solution works really well for me.. Have a great day ahead Commented Jan 15, 2018 at 20:10

create a shell script, getalert.sh, with following contents:

awk '
/^Debug .* Outgoing XML/{
  sub(/^.* Outgoing XML: /,"")
/<\/Alert>/ {
  if (LC>0) {print}

  print H


{ if (LC > 0) {
  } else {
    H = H $0
}' $2

run it as

getalert.sh mGMjhgHgffHhhFdH1u4 process.log

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .