0

I am trying to find an efficient way of searching through a whole set of files in a directory and only looking for a specific string up to the first comma.

Example of the postgres log file:

Apr 27 03:35:18 test postgres[24098]: [5-1] user=postgres,db=postgres,app=psqlclient=127.0.0.1
Apr 27 03:35:18 test postgres[24098]: [5-2] user=postgres,db=postgres,app=psqlclient=127.0.0.1 

I am only interested in the username used in the files. I could use pgbadger and look at it via HTML but would be quite time consuming.

So as an example, I would be able to see just :

user=postgres

As opposed to the whole set of text before and after the user.

However I am looking for any user not specifically postgres.

I have tried using grep on files but I only see results on just user=postgres.

Is there anyway of searching through a set of files for say user= up until the first comma as an example?

Or even search every file and remove anything that is before user= in each row, I could then maybe put into excel to get the result I need.

Any help is much appreciated.

0

2 Answers 2

2

Use GNU grep with PCRE:

grep -Po -- '(?<=user=).+?(?=,)' *.log

If you like to display the user= keyword too:

grep -o -- 'user=[^,]*' *.log

you can even display the file in which the match succeeded by adding the -H option to the grep command above (without it, the file name is only displayed if there is more than one file specified).

So the grep command become:

grep -Ho -- 'user=[^,]*' *.log

And the output:

pgsql.log:user=postgres
pgsql.log:user=postgres
1
  • Thanks @danielegrassini for this.
    – rdbmsNoob
    Jun 9, 2021 at 8:02
1

Using awk:

awk '/user=/{gsub(/^.*user=|,.*$/, "");print $0}' file

If you want to display user= and filename, then the command may be changed.

awk '/user=/{gsub(/^.*user=|,.*$/, "");
printf "%s:user=%s\n",FILENAME,$0}' *.log

In this command, if user= is found, then gsub()function taking characters from start of record touser=and following comma afteruserto end of record changes them to empty string("").

1
  • Thanks @prabhjot-singh for this, I will likely utilise this as it gives me the results I need.
    – rdbmsNoob
    Jun 9, 2021 at 8:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .