Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Use AWK (or SED) to get text between strings - include START string but exclude END string

I am trying to use AWK (or SED or a combination of both), to parse out log files that contain a spefic string "Info:AgentSession". I want to INCLUDE the line that contains the START string of "Info:AgentSession", but not include the END string line, which would be "[2015-" .

Here is a snippet of a text log file on a CentOS server:


[2015-03-30 12:23:10.999] [124] [Info:AgentSession] Handling Agent message for PieraC 
Request: ReceiveReady
Action: DoNotDisturb

[2015-03-30 12:23:11.000] [124] [Info:AgentSession] Sending agent message to PieraC 
Response: ReceiveReady
RequestId: 
Status: Ok
Message: 
IsReady: False

[2015-03-30 12:23:11.000] [49] [Info:Database] (BZ2411) (SqlTaskWorker.ProcessTasks) Attempting to run task. Thread: SqlTaskWorker-37. StartTime: 1/1/0001 12:00:00 AM. ConnectionTimeout: 15. ConnectionState: Open.

[2015-03-30 12:23:11.501] [111] [Info:Dialer] Sending Dialer message
Action: UsmCommand
Command: Transfer
IsTransfered: False

[2015-03-30 12:23:11.502] [111] [Info:AgentSession] Sending agent message to MatthewW 
ActivityState: Wrapup
IsReady: False
IsSipRegistered: True

[2015-03-30 12:23:11.502] [79] [Info:Database] (BZ2411) (SqlTask.Execute) Attempting to start. Thread: SqlTaskWorker-67. 

[2015-03-30 12:23:16.207] [124] [Info:AgentSession] Sending agent message to PieraC 
Response: NonQuery
Status: Ok
Message: Query sent successfully

[2015-03-30 12:23:16.207] [88] [Info:Database] (BZ2411) (SqlTaskWorker.ProcessTasks) Attempting to run task. Thread: SqlTaskWorker-76. 
[2015-03-30 12:23:16.207] [88] [Info:Database] (BZ2411) (SqlTask.Execute) Attempting to start. Thread: SqlTaskWorker-76. 
[2015-03-30 12:23:16.208] [88] [Info:Database] (BZ2411) (SqlNonQueryTask.ExecuteCommand) Attempting to start. Thread: SqlTaskWorker-76. 
[2015-03-30 12:23:16.268] [124] [Info:AgentSession] Handling Agent message for PieraC 
Request: CallAction
CallDisposition: 


When I run the following command:


awk '/Info:AgentSession/ {flag=1;next} /\[2015-/{flag=0} flag {print}' test.log


I get the following output:


Request: ReceiveReady
Action: DoNotDisturb

Response: ReceiveReady
RequestId:
Status: Ok
Message:
IsReady: False

ActivityState: Wrapup
IsReady: False
IsSipRegistered: True

Response: NonQuery
Status: Ok
Message: Query sent successfully

Request: CallAction
CallDisposition:


But I would like this output, to INCLUDE the START string of "Info:AgentSession", so to actually end up looking like this (Omitting all other sections of the log that do not referece the START string, using the beginning of the DATE string "[2015-" as the END string):


[2015-03-30 12:23:10.999] [124] [Info:AgentSession] Handling Agent message for PieraC 
Request: ReceiveReady
Action: DoNotDisturb

[2015-03-30 12:23:11.000] [124] [Info:AgentSession] Sending agent message to PieraC 
Response: ReceiveReady
RequestId: 
Status: Ok
Message: 
IsReady: False

[2015-03-30 12:23:11.502] [111] [Info:AgentSession] Sending agent message to MatthewW 
ActivityState: Wrapup
IsReady: False
IsSipRegistered: True


[2015-03-30 12:23:16.207] [124] [Info:AgentSession] Sending agent message to PieraC 
Response: NonQuery
Status: Ok
Message: Query sent successfully

[2015-03-30 12:23:16.268] [124] [Info:AgentSession] Handling Agent message for PieraC 
Request: CallAction
CallDisposition: 


Is this possible to do with a simple AWK or SED command?

like image 597
Chris Charles Avatar asked Feb 25 '26 21:02

Chris Charles


1 Answers

Using awk:

awk '/^[[]/{f=0} /Info:AgentSession/{f=1} f' file

How it works

awk loops through each line of input. For each line, the program decides whether to set the variable f to true (1) or false (0). If f is true, the line is printed.

  • /^[[]/{f=0}

    Anytime a line begins with [, f is set to false.

  • /Info:AgentSession/{f=1}

    If the line contains the string Info:AgentSession, then the previous command is overridden and f is set to true.

  • f

    If f is true, then awk prints the line.

    The above is shorthand for f{print $0} where, in awk, $0 means the whole line.

like image 130
John1024 Avatar answered Feb 27 '26 15:02

John1024