linux - 在另一个特定字符串之上搜索特定字符串

Question

我正在尝试编写一个(相当)简单的日志解析器来帮助我调试应用程序错误。

我目前正在努力实现的是找到“连接超时”的每个实例，然后找到字符串“处理文件”，它位于“连接超时”上方 10-30 行之间的某处(不总是相同数量的之间的线)。

我的代码目前看起来像这样:

!#/bin/bash
connectionTimeOutLines=`zcat filename | grep -n "Connection timed out" | cut -f1 -d:` #get the line number of all instances of connection timed out
for timeOutLine in "$connectionTimeOutLines"
do
     # get the date and time the event was logged
     logDate=`zcat filename | sed "${timeOutLine}q;d" | awk '{print $1}' | awk '{print substr($0,2)}'`
     logTime=`zcat filename | sed "${timeOutLine}q;d" | awk '{print $2}'`
     # need to get the "file processed line" here
     fileProcessed="unsure what I am doing here"
     echo "$fileProcessed timed out at $logTime on $logDate" >> /tmp/logFile.log
done

为简洁起见，我已经删除了部分代码，因为它与问题没有任何关系......即:我如何找到一个字符串的实例出现在另一个字符串之前？

我无法完全基于“正在处理文件”进行搜索，因为每次处理文件时都会出现该字符串，而我正在寻找处理失败的实例(“连接超时”)。

TBH，我不是 100% 我已经正确地解释了自己，所以我提前道歉 - 请在必要时要求任何澄清!

Answer 1

要解决这个问题，您首先必须消除输入中包含的不确定性:

... "Processing file" which comes somewhere between 10-30 lines above "Connection timed out" (not always the same number of lines between)

只需删除除感兴趣的行之外的所有行(那些包含“处理文件”或“连接超时”的行:

zcat filename | grep "Processing file\|Connection timed out"

我很确定您完全可以自己从经过预处理的输入中获取所需的数据。不过，完整的工作解决方案如下:

detect_timed_out_files

#!/bin/bash

F='Processing file'
T='Connection timed out'

grep "$F\|$T"                                                                  \
| sed -e "/$F/ {s/.\+Processing file \(.\+\)/\1/; h; d;}"                      \
      -e "/$T/ {H;x;s/\(\S\+\)\n\(\S\+\) \(\S\+\).*/\1 timed out at \3 on \2/}"

测试输入:

2016-06-24 01:23:45 Processing file xxx
Humpty
Dumpty
sat
2016-06-24 01:23:46 Processing file yyy
on
a
wall
2016-06-24 01:23:51 Connection timed out
Humpty
2016-06-24 01:23:52 Processing file zzz
Dumpty
had
a
2016-06-24 01:23:53 Processing file abc
2016-06-24 01:23:59 Connection timed out
great
fall

输出:

$ cat input|./detect_timed_out_files 
yyy timed out at 01:23:51 on 2016-06-24
abc timed out at 01:23:59 on 2016-06-24