1

I want to extract the logs between the current timestamp and 30 minutes before. I developed the below script but it's not working properly it shows only timestamp lines whereas I have to get untimestamped log lines in between such timestamped line. I have a log file containing this pattern:

script:

awk -v TSTART="$(date -v -30M "+%Y-%m-%d %H:%M")" -v TEND="$(date "+%Y-%m-%d %H:%M")" '$0>=TSTART && $0<=TEND' webservice_logs.log

Log file pattern:

2

You can print the lines based on a flag which is only set when the first field is a date field. see the following code with flag p to instruct awk to print (when p==1) or to skip (when p==0) the line

awk -v tstart="$start" -v tend="$end" '
    /^[0-9]{4}-[0-9]{2}-[0-9]{2}/ {
        t = $1 " " $2
        p = t >= tstart && t <= tend ? 1 : 0
    }p' webservice_logs.log

Since there is no timestamp at the beginning of ERROR lines, there is no flag change over such lines.

Edit On a single line:

awk -v tstart="$start" -v tend="$end" '/^[0-9]{4}-[0-9]{2}-[0-9]{2}/{t = $1 " " substr($2,1,5); p = t >= tstart && t <= tend ? 1 : 0}p' webservice_logs.log
  • This one is not working could you please help me with a one-liner. Above command is having spaces in between – abhinav mahajan Apr 11 at 11:51
  • @abhinavmahajan, updated. – jxc Apr 11 at 11:53
  • Sorry this one is not helping ThinkPad-E470:~$ awk -v tstart="$start" -v tend="$end" '/^[0-9]{4}-[0-9]{2}-[0-9]{2}/{t = $1 " " $2; p = t >= tstart && t <= tend ? 1 : 0}p' webservice_logs.log ThinkPad-E470:~$ – abhinav mahajan Apr 11 at 12:04
  • @abhinavmahajan what is the operating system? have you set up the variables $start and $end before running this awk command? – jxc Apr 11 at 12:07
  • Yes they have been set ThinkPad-E470:~$ echo $start 2019-03-22 13:23 ThinkPad-E470:~$ ThinkPad-E470:~$ ThinkPad-E470:~$ echo $end 2019-03-23 04:48 ThinkPad-E470:~$ awk -v tstart="$start" -v tend="$end" '/^[0-9]{4}-[0-9]{2}-[0-9]{2}/{t = $1 " " $2; p = t >= tstart && t <= tend ? 1 : 0}p' webservice_logs.log ThinkPad-E470:~$ – abhinav mahajan Apr 11 at 12:09
0

You can try this

awk -vStartDate=`date -d'now-30 min' +%H:%M:%S` '{ if ($2 > StartDate) print $0}' web.log
  • This one is not working – abhinav mahajan Apr 11 at 11:52
  • I have tested this on my machine with sample logs and it works. – Goron Apr 12 at 5:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.