Get logs for last 30 minutes

Question

I want to extract the logs between the current timestamp and 30 minutes before. I developed the below script but it's not working properly it shows only timestamp lines whereas I have to get untimestamped log lines in between such timestamped line. I have a log file containing this pattern:

script:

awk -v TSTART="$(date -v -30M "+%Y-%m-%d %H:%M")" -v TEND="$(date "+%Y-%m-%d %H:%M")" '$0>=TSTART && $0<=TEND' webservice_logs.log

Log file pattern:

Answer 1

You can print the lines based on a flag which is only set when the first field is a date field. see the following code with flag p to instruct awk to print (when p==1) or to skip (when p==0) the line

awk -v tstart="$start" -v tend="$end" '
    /^[0-9]{4}-[0-9]{2}-[0-9]{2}/ {
        t = $1 " " $2
        p = t >= tstart && t <= tend ? 1 : 0
    }p' webservice_logs.log

Since there is no timestamp at the beginning of ERROR lines, there is no flag change over such lines.

Edit On a single line:

awk -v tstart="$start" -v tend="$end" '/^[0-9]{4}-[0-9]{2}-[0-9]{2}/{t = $1 " " substr($2,1,5); p = t >= tstart && t <= tend ? 1 : 0}p' webservice_logs.log

Answer 2

You can try this

awk -vStartDate=`date -d'now-30 min' +%H:%M:%S` '{ if ($2 > StartDate) print $0}' web.log