I have a log file that I am attempting to pull a string out of. The numerical string is randomly generated and so far all of my attempts to use grep/sed/awk have been unsuccessful.

I have an entry like the following:


What I am trying to parse is the randomly generated portion of


Anyone have a quick and dirty method to get this to work?

  • 1
    This looks like it's from a longer JSON document. Could you share a bit more of the document's structure? It would be easy to pull it out with a JSON parser. – Kusalananda May 21 at 14:17

Quick and dirty like this?

$ grep -o -P '(?<=")[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}(?=")' input

Looks for any random "30c962de-b448-40ac-ade8-da6a8f49ce88" values with fixed length and dash - positions, enclosed in quotation marks, and prints it out. If you want to insist on the "id": part too, just add it to the leading quote condition (?<=").

However if that's JSON or anything sane you should consider using an appropriate parser for that kind of data (like jq or whatever).

  • Or you could have it use the whole length between the quotes, but make it non greedy. – stackzebra May 21 at 14:33
  • That works like a charm thanks!! It came from JSON but it is being logged to a log file and is being used elsewhere. – Kevin May 21 at 15:03

Another dirty trick using AWK on provided input.

echo $data  | awk -F , '{ print $1}' | awk -F id:  '{print $1}' | awk  '{print $1}'

If this is actually a JSON document, then using jq would pull the string out regardless of the formatting of the data:

jq -r '.document[2].part.id' file.json

This assumes that the id key is part of a part object, which is in turn part of a particular element in a document array at the top level of the JSON data structure.

Or, you could just extract all id values:

jq -r '.. | select(type=="object" and has("id")) | .id' file.json
  • I have not used jq so how would I use it to pull more than one value? Would I simply add multiple AND statements i.e. and has ("id" AND "status") or something similar?? – Kevin May 22 at 12:11
  • @Kevin As I wrote in my comment to the question, we don't know what your document's structure looks like. A query in with jq (or any other JSON parser) relies on pulling out or examining specific keys/values in the document, at specific places. The way the query is written is highly dependent on the structure of the JSON document. – Kusalananda May 22 at 12:36

Tried with below mentioned sed command and it worked fine too

command: sed 's/.*:"//1' filename|sed 's/".*//g'


sed 's/.*:"//1' filename |sed 's/".*//g'


using awk:

awk -F"[\":]" '{ print $5 }' infile

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.