Question

这让我感到困扰：

我有一个日志文件，以特定格式编写，例如：

[DEBUG    7] 2012-06-12 09:26:37.847 [MOD: UNK/0 ] [FILE:ModuleManager.cpp:541] [FUNC: ModuleManager::handleStatusRequestMessage] [MSG:Got request for unsupported ALLOCATION_STATUS ]

因此这些块很好地分开了。我正在通过尾部，在80x25终端屏幕上查看此日志，它看起来很糟糕（不，我无法更改屏幕，它是嵌入式设备）。

你能帮我创建一个tail / awk（或类似的）组合来实现类似的东西：

2012-06-12 09:26:37.847 Got request for unsupported ALLOCATION_STATUS

或

2012-06-12 09:26:37.847 ModuleManager::handleStatusRequestMessage - Got request for unsupported ALLOCATION_STATUS

或

2012-06-12 09:26:37.847 ModuleManager.cpp:541 ModuleManager::handleStatusRequestMessage - Got request for unsupported ALLOCATION_STATUS

从上面的长线？

由于

Answer 1

$ awk -F '[][]' '{print $3, $10}' logfile
2012-06-12 09:26:37.847  MSG:Got request for unsupported ALLOCATION_STATUS
$ awk -F '[][]' '{print $3, $8, $10}' logfile
 2012-06-12 09:26:37.847  FUNC: ModuleManager::handleStatusRequestMessage MSG:Got request for unsupported ALLOCATION_STATUS
$ awk -F '[][]' '{print $3, $6, $8, $10}' logfile
 2012-06-12 09:26:37.847  FILE:ModuleManager.cpp:541 FUNC: ModuleManager::handleStatusRequestMessage MSG:Got request for unsupported ALLOCATION_STATUS

或

$ awk -F '[][]|MOD:|FUNC:|FILE:|MSG:' '{print $3, $8, $11 " - " $14}' inputfile
2012-06-12 09:26:37.847  ModuleManager.cpp:541  ModuleManager::handleStatusRequestMessage - Got request for unsupported ALLOCATION_STATUS

Answer 2

我建议sed以激进的格式消灭：

tailf -f logfile | sed -e 's/\[MSG:\([^]]*\)\]/\1/' -e 's/\[[^]]*\] *//g'

尾随一个笨拙的日志

2 个答案: