Question

我想使用awk过滤一些日志文件，查找具有某些特定请求ID的行。这是我的日志文件的一部分：

2014-01-16 00:00:36,862 DEBUG [CalculationLog] REQUEST:9822897effffffc06a4be2a523754852 zkTestScheduledFormula contract invoked
2014-01-16 00:01:36,822 DEBUG [CalculationLog] REQUEST:982373b5ffffffc06a4be2a5480cb66a zkTestScheduledFormula contract invoked
2014-01-16 00:02:36,940 DEBUG [CalculationLog] REQUEST:98245e8cffffffc06a4be2a555021fe6 zkTestScheduledFormula contract invoked
2014-01-16 00:03:37,199 DEBUG [CalculationLog] REQUEST:982549eeffffffc06a4be2a557aa8d3a zkTestScheduledFormula contract invoked
2014-01-16 00:04:37,446 DEBUG [CalculationLog] REQUEST:98263546ffffffc06a4be2a58411decd zkTestScheduledFormula contract invoked
2014-01-16 00:05:37,742 DEBUG [CalculationLog] REQUEST:982720cdffffffc06a4be2a5c7f7d2a1 zkTestScheduledFormula contract invoked
2014-01-16 00:06:37,890 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
here
is
some
text
2014-01-16 00:07:38,096 DEBUG [CalculationLog] REQUEST:9828f6efffffffc06a4be2a5bb4f7883 zkTestScheduledFormula contract invoked
2014-01-16 00:08:38,386 DEBUG [CalculationLog] REQUEST:9829e272ffffffc06a4be2a5fa9054ea zkTestScheduledFormula contract invoked
2014-01-16 00:11:38,677 DEBUG [CalculationLog] REQUEST:982ca2b4ffffffc06a4be2a57d1274ed zkTestScheduledFormula contract invoked
2014-01-16 00:12:39,016 DEBUG [CalculationLog] REQUEST:982d8e68ffffffc06a4be2a5ef067a13 zkTestScheduledFormula contract invoked
2014-01-16 00:13:39,567 DEBUG [CalculationLog] REQUEST:982e7aefffffffc06a4be2a5e34e2938 zkTestScheduledFormula contract invoked
2014-01-16 00:14:39,910 DEBUG [CalculationLog] REQUEST:982f66a4ffffffc06a4be2a5a6efe09f zkTestScheduledFormula contract invoked
2014-01-16 00:25:42,276 DEBUG [CalculationLog] REQUEST:98398204ffffffc06a4be2a509da6070 zkTestScheduledFormula contract invoked
2014-01-16 00:26:42,451 DEBUG [CalculationLog] REQUEST:983a6d12ffffffc06a4be2a52686b6da zkTestScheduledFormula contract invoked
2014-01-16 00:27:42,554 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
2014-01-16 00:28:42,769 DEBUG [CalculationLog] REQUEST:983c430fffffffc06a4be2a54d9c2af4 zkTestScheduledFormula contract invoked
2014-01-16 00:34:44,150 DEBUG [CalculationLog] REQUEST:9841c6b5ffffffc06a4be2a55719bea1 zkTestScheduledFormula contract invoked
2014-01-16 00:35:44,342 DEBUG [CalculationLog] REQUEST:9842b1d6ffffffc06a4be2a517e47e3f zkTestScheduledFormula contract invoked
2014-01-16 00:36:44,527 DEBUG [CalculationLog] REQUEST:98439cefffffffc06a4be2a5de1291de zkTestScheduledFormula contract invoked
2014-01-16 00:37:44,790 DEBUG [CalculationLog] REQUEST:98448856ffffffc06a4be2a555d6c6d7 zkTestScheduledFormula contract invoked
2014-01-16 00:38:44,975 DEBUG [CalculationLog] REQUEST:9845736dffffffc06a4be2a5f1b61900 zkTestScheduledFormula contract invoked
2014-01-16 00:47:46,866 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
here also
is something
it may
be some
exception
and I want
to print it
2014-01-16 00:51:48,271 DEBUG [CalculationLog] REQUEST:9851672fffffffc06a4be2a55cbc8aae zkTestScheduledFormula contract invoked
2014-01-16 00:55:49,325 DEBUG [CalculationLog] REQUEST:985514ccffffffc06a4be2a5ec3ad03c zkTestScheduledFormula contract invoked
2014-01-16 01:01:51,193 DEBUG [CalculationLog] REQUEST:985a9a59ffffffc06a4be2a5c7f22685 zkTestScheduledFormula contract invoked
2014-01-16 01:03:51,553 DEBUG [CalculationLog] REQUEST:985c7081ffffffc06a4be2a5f888aa10 zkTestScheduledFormula contract invoked
2014-01-16 01:04:51,816 DEBUG [CalculationLog] REQUEST:985d5be8ffffffc06a4be2a5ad80c024 zkTestScheduledFormula contract invoked
2014-01-16 01:13:53,211 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
2014-01-16 01:14:53,342 DEBUG [CalculationLog] REQUEST:9866899dffffffc06a4be2a5207c84d0 zkTestScheduledFormula contract invoked
2014-01-16 01:15:53,455 DEBUG [CalculationLog] REQUEST:9867746fffffffc06a4be2a53ae4e293 zkTestScheduledFormula contract invoked
2014-01-16 01:16:53,617 DEBUG [CalculationLog] REQUEST:98685f71ffffffc06a4be2a525a15b99 zkTestScheduledFormula contract invoked
2014-01-16 01:17:53,723 DEBUG [CalculationLog] REQUEST:98694a3bffffffc06a4be2a5526c88e3 zkTestScheduledFormula contract invoked

要过滤此日志文件，我是按照awk脚本编写的：

{for(i=1;i<=NF;i++){ if(match($i, /REQUEST:[0-9a-z]*/)){currentRequest = substr($i, 9); break; } } }
currentRequest == "98280bc2ffffffc06a4be2a5d6b0c173" {printLine = true; foundFirst = true; print "+++"}
currentRequest != "98280bc2ffffffc06a4be2a5d6b0c173" {printLine = false; print "---"}
{if (printLine == true && foundFirst == true) print $0}

我不知道为什么我的printLine变量总是等于true并且所有行都被打印出来。我想在打印和删除的行之前看到“+++”和“---”。但所有这些都是印刷的。有没有人知道什么是错的？

Answer 1

基本问题

引用它们时，true和false只是awk变量，因此两者都具有值0。

改为使用0和1：

{for(i=1;i<=NF;i++){ if(match($i, /REQUEST:[0-9a-z]*/)){currentRequest = substr($i, 9); break; } } }
currentRequest == "98280bc2ffffffc06a4be2a5d6b0c173" {printLine = 1; foundFirst = 1; print "+++"}
currentRequest != "98280bc2ffffffc06a4be2a5d6b0c173" {printLine = 0; print "---"}
{if (printLine == 1 && foundFirst == 1) print $0}

脚本有很大的改进空间，但这是你遇到的关键点。

更广泛地重写

我正在阅读这些内容，但我认为这个脚本可能就是你所追求的。看起来好像你想要一个具有指定请求编号的行块在+++之前，并以---结尾;你可能不希望打印任何其他行。因此，输出将为+++，后跟请求的一行或多行，然后是---，必要时会重复。

BEGIN { req = "REQUEST:98280bc2ffffffc06a4be2a5d6b0c173" }
      { if ($5 == req)
        {
            if (!printing) print "+++"
            printing = 1
        }
        else
        {
            if (printing) print "---"
            printing = 0
        }
        if (printing) print $0
      }
END   { if (printing) print "---" }

鉴于您显示的数据的温和修改版本，它会产生输出：

+++
2014-01-16 00:06:37,890 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---
+++
2014-01-16 00:27:42,554 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---
+++
2014-01-16 00:47:46,866 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---
+++
2014-01-16 01:13:53,211 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
2014-01-16 01:13:53,222 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
2014-01-16 01:13:53,233 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---
+++
2014-01-16 01:18:00,999 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---

'轻微修改'是（1）为请求添加两个额外的行，数据中的小数秒222和233（因此对于同一请求存在3个连续行的块），以及（2）添加请求在文件的末尾（以测试END块）。

变量在awk中始终等于true

1 个答案:

基本问题

更广泛地重写