I want to be able to utilize a 'grep' or 'pcregrep -M' like solution that parses a log file that fits the following parameters:
So in the example below I would want to return every line that has KEY1 on it and all the supporting lines below it until the next log message.
Log file: 01 Feb 2010 - 10:39:01.755, DEBUG - KEY1:randomtext blah blah2 T blah3 T blah4 F blah5 F blah6 blah7 01 Feb 2010 - 10:39:01.757, DEBUG - KEY1:somethngelse 01 Feb 2010 - 10:39:01.758, DEBUG - KEY2:randomtest this is a test 01 Feb 2010 - 10:39:01.760, DEBUG - KEY1:more logs here 01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:eve more here this is another multiline log entry keeps on going but not as long as before 01 Feb 2010 - 10:39:01.763, DEBUG - KEY2:testing test test test end of key2 01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:but key 1 is still going and going and going and going and going and going and going and going and going and going and going and going and going okay enough 01 Feb 2010 - 10:39:01.762, DEBUG - KEY3:and so on and on
Desired output of searching for KEY1: 01 Feb 2010 - 10:39:01.755, DEBUG - KEY1:randomtext blah blah2 T blah3 T blah4 F blah5 F blah6 blah7 01 Feb 2010 - 10:39:01.757, DEBUG - KEY1:somethngelse 01 Feb 2010 - 10:39:01.760, DEBUG - KEY1:more logs here 01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:eve more here this is another multiline log entry keeps on going but not as long as before 01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:but key 1 is still going and going and going and going and going and going and going and going and going and going and going and going and going okay enough
I was trying to do something like:
pcregrep -M 'KEY1(.*\n)+' logfile
but definitely doesn't work right.
if you are on *nix, you can use the shell
#!/bin/bash
read -p "Enter key: " key
awk -vkey="$key" '
$0~/DEBUG/ && $0 !~key{f=0}
$0~key{ f=1 }
f{print} ' file
output
$ cat file
01 Feb 2010 - 10:39:01.755, DEBUG - KEY1:randomtext
blah
blah2 T
blah3 T
blah4 F
blah5 F
blah6
blah7
01 Feb 2010 - 10:39:01.757, DEBUG - KEY1:somethngelse
01 Feb 2010 - 10:39:01.758, DEBUG - KEY2:randomtest
this is a test
01 Feb 2010 - 10:39:01.760, DEBUG - KEY1:more logs here
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:eve more here
this is another multiline log entry
keeps on going
but not as long as before
01 Feb 2010 - 10:39:01.763, DEBUG - KEY2:testing
test test test
end of key2
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:but key 1 is still going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
okay enough
01 Feb 2010 - 10:39:01.762, DEBUG - KEY3:and so on
and on
$ ./shell.sh
Enter key: KEY1
01 Feb 2010 - 10:39:01.755, DEBUG - KEY1:randomtext
blah
blah2 T
blah3 T
blah4 F
blah5 F
blah6
blah7
01 Feb 2010 - 10:39:01.757, DEBUG - KEY1:somethngelse
01 Feb 2010 - 10:39:01.760, DEBUG - KEY1:more logs here
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:eve more here
this is another multiline log entry
keeps on going
but not as long as before
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:but key 1 is still going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
okay enough
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With