假设每个记录都以时间戳开始,然后是所有大写字母的字符串,然后是方括号内的另一个字符串:
$ cat tst.awk
/^[0-9]{4}(-[0-9]{2}){2} [0-9]{2}(:[0-9]{2}){2},[0-9]{3} [[:upper:]]+ \[[^][]+\] / { prt() }
{ rec = (rec=="" ? "" : rec ORS) $0 }
END { prt() }
function prt() {
if (rec ~ regexp) {
print rec
print "----"
}
rec = ""
}
$ awk -v regexp='here' -f tst.awk file
2018-04-18 03:48:07,043 ERROR [properties] (Thread-13) UpdateType: more data coming here; ProcessId: 5010
----
2018-04-17 13:22:24,230 INFO [log] I need to retrieve this string here
and also this one as it is part of the same text
----
如果没有足够的限制,您可以将起始regexp更改为其他内容,例如,如果记录中的文本在下一行的开始处以与该regexp匹配的字符串结尾(尽管我不知道您实际如何处理,因为您已经向我们展示了这些内容)。
另外,想想这是在做什么:
$ cat tst.awk
/^[0-9]{4}(-[0-9]{2}){2} [0-9]{2}(:[0-9]{2}){2},[0-9]{3} [[:upper:]]+ \[[^][]+\] / { prt() }
{ rec = (rec=="" ? "" : rec ORS) $0 }
END { prt() }
function prt( flds,recDate,recTime,recPrio,recType,recText) {
split(rec,flds)
recDate = flds[1]
recTime = flds[2]
recPrio = flds[3]
recType = flds[4]
gsub(/[][]/,"",recType)
recText = rec
sub(/([^[:space:]]+ ){4}/,"",recText)
gsub(/[[:space:]]+/," ",recText)
if (NR > 1) {
if ( date=="" || date==recDate ) {
printf "date = <%s>\n", recDate
printf "time = <%s>\n", recTime
printf "prio = <%s>\n", recPrio
printf "type = <%s>\n", recType
printf "text = <%s>\n", recText
print "----"
}
}
rec = ""
}
。
$ awk -v date='2018-04-18' -f tst.awk file
date = <2018-04-18>
time = <03:48:07,043>
prio = <ERROR>
type = <properties>
text = <(Thread-13) UpdateType: more data coming here; ProcessId: 5010>
----
。
$ awk -f tst.awk file
date = <2018-04-17>
time = <03:59:29,243>
prio = <TRACE>
type = <xml>
text = <This is just a test.>
----
date = <2018-04-17>
time = <13:22:24,230>
prio = <INFO>
type = <properties>
text = <I believe this is another test.>
----
date = <2018-04-18>
time = <03:48:07,043>
prio = <ERROR>
type = <properties>
text = <(Thread-13) UpdateType: more data coming here; ProcessId: 5010>
----
date = <2018-04-17>
time = <13:22:24,230>
prio = <INFO>
type = <log>
text = <I need to retrieve this string here and also this one as it is part of the same text>
----
date = <2018-04-17>
time = <13:22:24,230>
prio = <INFO>
type = <det>
text = <I believe this is another test.>
----
想象一下,使用这种方法,您可以轻松地在日志记录的特定字段上创建精确的查询,生成CSV以导入Excel等。。。