Using sed, grep, awk, or ruby, what's a simple way to find the last match of a string in a larger log file, and send every line following it (inclusive) to another file?


grep -A222 "_____________" recent/toptrigs.OX.rb.log

is my nearest workaround, since 222 lines of context afterword should always hit EOF first, except that I want it to start from the last instance of "_____" string. It's a logfile simultaneously growing from the same process (so I manually flush STDOUT and STDERR at the end of each item's loop, with this segment cutting in mind).

  • Prefer a regex-based solution (avoiding double-tac on a large file in a fast loop) – Marcos Dec 12 '12 at 10:50

I think the easiest way is to reverse the input before matching:

<logfile tac | sed '/pattern/q' | tac
  • I was trying to avoid that too since the main logfile grows many MB's huge, and the iterations fast (don't want to slow them down by a large fraction), so was looking for a regex-only solution. – Marcos Dec 12 '12 at 10:41
  • @Marcos: no matter the solution it needs to determine the offset to your pattern from the end-of-file. Based on my non-exhaustive experiments the solution I suggested seems to be the most efficient. – Thor Dec 12 '12 at 11:16

Some options here.

  • You could utilize tac to reverse the order of lines, then making grep include the line after (now before as it's reversed) and stop it after the first match, then reverse it again to restore the order, like this:

    tac /path/to/file | grep -m 1 -B 1 "mypattern" | tac
  • Strip out lines besides the last match and the line following:

    grep -A 1 "mypattern" /path/to/file | tail -n 2

You should try this on your files to see which performs better in your case.

And you can append the output to a log file by prepending the commands with standard output redirection >> /path/to/outputfile.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.