1

I want to extract the logs between the current timestamp and 30 minutes before. I developed the below script but it's not working properly it shows only timestamp lines whereas I have to get untimestamped log lines in between such timestamped line. I have a log file containing this pattern:

script:

awk -v TSTART="$(date -v -30M "+%Y-%m-%d %H:%M")" -v TEND="$(date "+%Y-%m-%d %H:%M")" '$0>=TSTART && $0<=TEND' webservice_logs.log

Log file pattern:

2 Answers 2

2

You can print the lines based on a flag which is only set when the first field is a date field. see the following code with flag p to instruct awk to print (when p==1) or to skip (when p==0) the line

awk -v tstart="$start" -v tend="$end" '
    /^[0-9]{4}-[0-9]{2}-[0-9]{2}/ {
        t = $1 " " $2
        p = t >= tstart && t <= tend ? 1 : 0
    }p' webservice_logs.log

Since there is no timestamp at the beginning of ERROR lines, there is no flag change over such lines.

Edit On a single line:

awk -v tstart="$start" -v tend="$end" '/^[0-9]{4}-[0-9]{2}-[0-9]{2}/{t = $1 " " substr($2,1,5); p = t >= tstart && t <= tend ? 1 : 0}p' webservice_logs.log
11
  • This one is not working could you please help me with a one-liner. Above command is having spaces in between Commented Apr 11, 2019 at 11:51
  • @abhinavmahajan, updated.
    – jxc
    Commented Apr 11, 2019 at 11:53
  • Sorry this one is not helping ThinkPad-E470:~$ awk -v tstart="$start" -v tend="$end" '/^[0-9]{4}-[0-9]{2}-[0-9]{2}/{t = $1 " " $2; p = t >= tstart && t <= tend ? 1 : 0}p' webservice_logs.log ThinkPad-E470:~$ Commented Apr 11, 2019 at 12:04
  • @abhinavmahajan what is the operating system? have you set up the variables $start and $end before running this awk command?
    – jxc
    Commented Apr 11, 2019 at 12:07
  • Yes they have been set ThinkPad-E470:~$ echo $start 2019-03-22 13:23 ThinkPad-E470:~$ ThinkPad-E470:~$ ThinkPad-E470:~$ echo $end 2019-03-23 04:48 ThinkPad-E470:~$ awk -v tstart="$start" -v tend="$end" '/^[0-9]{4}-[0-9]{2}-[0-9]{2}/{t = $1 " " $2; p = t >= tstart && t <= tend ? 1 : 0}p' webservice_logs.log ThinkPad-E470:~$ Commented Apr 11, 2019 at 12:09
0

You can try this

awk -vStartDate=`date -d'now-30 min' +%H:%M:%S` '{ if ($2 > StartDate) print $0}' web.log
2
  • This one is not working Commented Apr 11, 2019 at 11:52
  • I have tested this on my machine with sample logs and it works.
    – Gowtham
    Commented Apr 12, 2019 at 5:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .