I have two fields in logs sending time and received time mentioned in milliseconds, I have to find difference between these two fields, if it's greater than 2 seconds print those logs using shell script or Linux commands.

2017-01-27 object1(sendtime-1486743904359 ,recdtime-  1486743904500)
2017-01-27 object2(sendtime-1486743904800 ,recdtime-  1486743908000)

my log files contains other lines also, which i need filter out based on above send/received time condition and only logs which contains "sendobject" keyword. Others like request sent, request received should be ignored

Log Details--

2017-01-27 [Info]Delta Cache sendobject (empId-emp1, joindate-456,dealdate-123,sendtime-1527348020000 ,recdtime-1527348028000, salary-1k,amtpaid-EUR)
2017-01-27 [Info]Delta Cache sendobject (empId-emp2, joindate-456,dealdate-123,sendtime-1527348073000 ,recdtime-1527348074000, salary-1k,amtpaid-AUD)
2017-01-27 [Info]Requestsent| (empId-emp1, joindate-456,dealdate-123,sendtime-1527352812000 ,recdtime-1527352820000, salary-1k,amtpaid-INR)
2017-01-27 [Info]Delta Cache sendobject (empId-emp3, joindate-456,dealdate-123,sendtime-1527349111000 ,recdtime-1527349112000, salary-1k,amtpaid-GBP)
2017-01-27 [Info]Delta Cache sendobject (empId-emp4, joindate-456,dealdate-123,sendtime-1527349370000 ,recdtime-1527349375000, salary-1k,amtpaid-CAD)
2017-01-27 [Info]Requestrecicved| (empId-emp1, joindate-456,dealdate-123,sendtime-1527352812000 ,recdtime-1527352820000, salary-1k,amtpaid-INR)
2017-01-27 [Info]Delta Cache sendobject (empId-emp6, joindate-456,dealdate-123,sendtime-1527352812000 ,recdtime-1527352820000, salary-1k,amtpaid-INR)
2017-01-27 [Info]DBupdated| (empId-emp1, joindate-456,dealdate-123,sendtime-1527352812000 ,recdtime-1527352820000, salary-1k,amtpaid-INR)
  • Is there any specific time for sendtime and recdtime ? – jayeshkh007 May 17 '18 at 6:57
  • The first set of example lines you gave (containing "object1" & "object2") and the ones mentioned later under "Log Details--" have very different format. You need to fix the format. – alwayslearning May 26 '18 at 19:30
  • answer edited.- – αғsнιη May 27 '18 at 5:22
  • Later updated logs are final one.. – Unix1 May 27 '18 at 18:18

With awk you can do like:

awk -F"[- ,)]" '$(NF-1)-$5 >2000' infile
2017-01-27 object2(sendtime-1486743904800 ,recdtime-  1486743908000)

Here we defines sets of hyphen, space, comma and close parenthesis as fields separators.

to answer the revised question, try:

awk -F"[- ,]" '/sendobject/ && $18-$15 >2000' infile
| improve this answer | |

A variant on @αғsнιη's answer:

awk -F'(sen|rec)dtime-' 'NF==3 && $3 - $2 > 2000'

Or, if the logs contain all sorts of lines beside these ones, you could be even more restrictive in matching the input with perl:

perl -ne 'print if m{
    \)$}x && $2 - $1 > 2000'
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.