-4

我正在尝试逐行读取特定字符串及其值的日志文件。

例如，我有一个如下的日志文件：

 ####<Sep 26, 2013 12:05:22 AM MDT> <Error> <comApp> <ap001> <Server12> <[ACTIVE]      ExecuteThread: '55' for queue:    'weblogic.kernel.Default (self-tuning)'> <<anonymous>> <>    <>    <1380175522589> <000000> <<ERROR>Exception ID: 971 -  Rate with    ResParameters-> MAT: SJC GHT: FJC PUD: Fri Sep 27 09:00:00 MDT 2013>     
 ####<Sep 26, 2013 12:05:22 AM MDT> <Error> <comApp> <ap001> <Server12> <[ACTIVE] ExecuteThread: '55' for queue:    'weblogic.kernel.Default (self-tuning)'> <<anonymous>> <> <>    <1380175522593> <000000> <<ERROR>Exception ID: 971 -  Rate with    ResParameters-> MAT: SJC GHT: FJC PUD: Fri Sep 27 09:00:00 MDT 2013>     
 ####<Sep 26, 2013 12:05:22 AM MDT> <> <Error> <comApp> <ap001> <Server12> <[ACTIVE] ExecuteThread: '55' for queue:    'weblogic.kernel.Default (self-tuning)'> <<anonymous>> <> <>    <1380175522597> <000000> <<ERROR>Exception ID: 971 -  Rate with    ResParameters-> MAT: SJC GHT: FJC PUD: Fri Sep 27 09:00:00 MDT 2013>

我需要从定义的字符串 MAT:、GHT:、PUD 中读取值：

我想要得到的输出是：

SJC , FJC, Fri Sep 27 09:00:00 MDT 2013
DJA , SJC, Fri Sep 27 09:00:00 MDT 2013
FJC , KJC, Fri Sep 27 09:00:00 MDT 2013
JJC , SJC, Fri Sep 27 09:00:00 MDT 2013
4

3 回答 3

1

使用sed：

sed -r 's/.*MAT:\s*(\w+)\s+GHT:\s*(\w+)\s+PUD:\s*(.+)\s*>/\1, \2, \3/g' infile > outfile

相同的搜索和替换可用于perl

perl -pe 's/.*MAT:\s*(\w+)\s+GHT:\s*(\w+)\s+PUD:\s*(.+)\s*>/\1, \2, \3/g' infile > outfile

测试您的样本数据：

$ cat infile 
 ####<Sep 26, 2013 12:05:22 AM MDT>  <<anonymous>> <>  MAT: SJC GHT: FJC PUD: Fri Sep 27 09:00:00 MDT 2013 > 
 ####<Sep 26, 2013 12:05:22 AM MDT>  <<anonymous>> <>  MAT: DJA GHT: SJC PUD: Fri Sep 27 09:00:00 MDT 2013 >
 ####<Sep 26, 2013 12:05:22 AM MDT>  <<anonymous>> <>  MAT: FJC GHT: KJC PUD: Fri Sep 27 09:00:00 MDT 2013 >
 ####<Sep 26, 2013 12:05:22 AM MDT>  <<anonymous>> <>  MAT: JJC GHT: SJC PUD: Fri Sep 27 09:00:00 MDT 2013 >

$ cat outfile 
SJC, FJC, Fri Sep 27 09:00:00 MDT 2013 
DJA, SJC, Fri Sep 27 09:00:00 MDT 2013
FJC, KJC, Fri Sep 27 09:00:00 MDT 2013
JJC, SJC, Fri Sep 27 09:00:00 MDT 2013
于 2013-10-03T18:57:43.633 回答
1

既然你标记了 Perl

perl -ne 'if($_=~/MAT: (\S+) GHT: (\S+) PUD: (\S+ \S+ \d+ \d\d:\d\d:\d\d \S+ \d\d\d\d)/){ print "$1,$2,$3\n" ;}' test.txt
于 2013-10-03T19:05:55.503 回答
0 
perl -F'\W*(?:MAT|GHT|PUD):\W*' -lane'shift@F; s|>\s*$||for@F; print join", ",@F' file

输出

SJC, FJC, Fri Sep 27 09:00:00 MDT 2013
SJC, FJC, Fri Sep 27 09:00:00 MDT 2013
SJC, FJC, Fri Sep 27 09:00:00 MDT 2013
于 2013-10-03T20:06:56.140 回答