Question

我想只删除文件的更新行而不是整个内容

tail -F / path to file

显示文件中的所有行。我只需要显示添加到文件中的新行，任何人都可以帮助我吗？

例如我想只看到文件中的更新行，例如，如果文件有10行尾 - -F现在我在终端上显示10行如果再添加5行我应该只能看到新的5行而不是所有15行

修改我已配置flume将日志数据发送到hbase我正在使用“tail -F / path to file” 每次更新文件时都会给我所有行。只更新日志数据（比如添加5行）应发送到hbase，否则会有数据冗余。

问候Chhaya

Answer 1

我认为该文件是日志文件？

所以也许，不是试图想出一种方法来记住最后一次写的内容，而只显示新内容，你可能想要使用一个日志系统[比如syslogd，或者它的更新版本]，并告诉它记录在文件中并将其发送到水槽？

否则，这是一个肮脏的黑客：创建一个“shownew.sh”文件，其中包含：

#try to be as "atomic" as possible: we will all do with a copy of ${1}, to "freeze" time
cp -p "${1}" "${1}.cur"  #very important. "freezes" the state of $1

if [ -f "${1}.old ]; then

   diff "${1}.old" "${1}.cur" | grep '^> ' | sed -e 's/^> //'

else

   cat "${1}.cur" #show the file at the time of invocation

fi

mv -f "${1}.cur" "${1}.old"  #we just showed "${1}.cur" (or the diff between ${1}.cur and a previous ${1}.old=.
  # so we now move that ${1}.cur $^{1}.old, for the next iteration
  #We used a ${1}.cur instead of ${1} because ${1} may be updated at any time, and it's possible we copy a "$1" updated since the display of differences! By using ${1}.cur instead, this won't be a problem

#edit: after the OP's comment he wants to tail -f the file too:
#and now we showed the diffs since $1.old, we continue to display what is new in $1, using tail -f:

#since we showed ${1}.cur (now known as ${1}.old}, $1 may have changed?
diff "${1}" "${1}.old" | grep '^> ' | sed -e 's/> //' 

#and now we tail -f on $1 to show what's incoming, until the user press ctrl+C
tail -n 0 -f "${1} 

#we showed the complete ${1}, this becomes the new ${1}.old
cp "${1}" "${1}.old"

首次调用shownew.sh /some/file时：如果是第一次在/some/file上调用它，则会显示整个内容。
每次调用脚本时，shownew.sh /some/file：它只显示现在位于“$ {1}”中的行，而不是之前的“$ {1} .old”行。 ..我希望那是你想要的？

Answer 2

如果您的日志事件来自Java日志框架，那么我建议使用Log4j2 Flume appender。这将确保最新的事件很快得到解决。

Tailing只更新了文件行

2 个答案: