3

I have a .log file where each entry is on the form

2018-09-28T10:53:48,006 [Jetty-6152  ] INFO  [correlationId] my.package.service:570 - Inbound request: 1.2.3.4 - GET - 12342ms - 200 - /json/some/resource
2018-09-28T11:53:48,006 [Jetty-6152  ] INFO  [correlationId] my.package.service:570 - Inbound request: 1.2.3.4 - GET - 204ms - 200 - /json/other/resource

How do I find all entries where the request took longer than 5 seconds? that is the entry contains the text "[numberGreaterThan5000]ms"?

  • If you have tried something you should post the code that you tried and how it failed as well. So we can see that you did some work for yourself first and also can help you improve that code. (I posted a quick reply anyway.) – Lucas Sep 30 '18 at 9:24
  • 1
    Could you please clarify the question. How you want to find: that is the entry contains the text "[numberGreaterThan5000]ms"? this statement is ` "[numberGreaterThan5000]ms"` not in your example? – user90704 Sep 30 '18 at 13:21
  • @TNT the sentence before that should explain it very well. They try to find any line where that number before the string "ms" is greater than 5000. – Lucas Oct 1 '18 at 12:43
2

I think this should do it:

grep -E '([5-9][0-9]{3}|[0-9]{5,})ms' | grep -v 5000ms

How does it work?

  1. It uses -E so the regex is of the "modern" format (also called extended). It just makes the typing easier in our case as we can save some \ chars.
  2. The (...|...)ms searches for two alternatives followed by the string ms. This is necessary as regex can not compare numbers so I can not say something like >= 5000.
  3. The first alternative is [5-9][0-9]{3} which will match any string that starts with a number from 5 to 9 followed by 3 occurrences of numbers from 0 to 9. Those are all numbers >= 5000 and < 10000.
  4. The second alternative will match a string of 5 or more digits, that is any number >= 10000.
  5. At the end we pipe the result to grep -v 5000ms to filter out any occurrence of 5000ms because you said greater than 5000. If you want greater or equal just leave that out.

Where to learn more?

Read man 1 grep and man 7 regex.

  • Downvoters: care to explain why? – Lucas Oct 1 '18 at 12:41
1

Generally you should avoid trying to build numeric comparisons out of regular expressions - use something like awk or perl that can do actual numeric comparisons e.g.

gawk -v x=5000 'match($0,/([0-9]+)ms/,a) && a[1]+0 > x' file.log

or

perl -ne 'print if /(\d+)ms/ && $1 > 5000' file.log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.