Hello,

I have a error logfile that looks like this:
2012 Feb 09 09:12:34:824 GMT +1 All ok
dsf
dfd
2012 Feb 09 09:12:34:824 GMT +1 Error in bla
sdff
2012 Feb 09 09:12:34:824 GMT +1 Next Ok line
sx
2012 Feb 09 09:12:34:824 GMT +1 Ok line
2012 Feb 09 09:12:34:824 GMT +1 This is an other Error
rwere
erdfsr
dsfr
dsfsdf
2012 Feb 09 09:12:34:824 GMT +1 yet an other Error
fgdfds


So I want to display all lines containing Error and the lines ather it until the next date time stamp is found.

So output should be like this:
2012 Feb 09 09:12:34:824 GMT +1 Error in bla
sdff
2012 Feb 09 09:12:34:824 GMT +1 This is an other Error
rwere
erdfsr
dsfr
dsfsdf
2012 Feb 09 09:12:34:824 GMT +1 yet an other Error
fgdfds

Better show us your attempts so we can comment, and maybe help.

I'm no grep / sed / awk guru, thats the main problem.

The best I got up until now:
grep --after-context 20 Error

This kinda works, but now I have too much lines or not enough if the error is more then 20 lines.

So are the additional lines of the error ever going to start with a number? or the Year? You need to use what you know about the data to tell grep/sed/awk when to start / stop.

So the additional lines will never contain the date time string format like this "2012 Feb 09 09:08:59:812 GMT +1" at the beginning of the line, but it can also have no additional lines.

Some examples:
2012 Feb 09 09:08:59:810 GMT +1 message.log Error User [test-User] E <EventName> Name <EventID> ID:<124871.1328774907808.0> <ProcessID> 7637458 <Message> <ProcessStack> <Class> <CustomLog> HTTP Error: Webservice unvailable <EventProperties> Adapter=adatpername, Engine=endpoint, ApplicationStatus=4367
2012 Feb 09 09:08:59:812 GMT +1 message.log Error User [test-User] Event timeout. <EventName> Name <EventID> ID:<124871.1328774907808.0> <ProcessID> 7637458 <Message> Activity timed out <ProcessStack> SOAPRequestReply <Class> ActivityTimedOutException <CustomLog> Timeout
<ns0:ErrorReport xmlns:ns0="Schema.xsd"><ns0:StackTrace>Job-7637458 Error in [SOAPRequestReply]
Activity timed out
at com.tibco.pe.core.TaskImpl.eval(Unknown Source)
at com.tibco.pe.core.Job.a(Unknown Source)
at com.tibco.pe.core.Job.k(Unknown Source)
at com.tibco.pe.core.JobDispatcher$JobCourier.a(Unknown Source)
at com.tibco.pe.core.JobDispatcher$JobCourier.run(Unknown Source)
</ns0:StackTrace><ns0:Msg>Activity timed out</ns0:Msg><ns0:FullClass>com.tibco.pe.plugin.ActivityTimedOutException</ns0:FullClass><ns0:Class>ActivityTimedOutException</ns0:Class><ns0:ProcessStack>StackName</ns0:ProcessStack><ns0:MsgCode>BWENGINE-100029</ns0:MsgCode><ns0ata/></ns0:ErrorReport> <EventProperties> Adapter=adatpername, Engine=endpoint, ApplicatieStatus=5, Adapter=adatpername, Engine=endpoint
2012 Feb 09 09:08:59:813 GMT +1 message.log User [test-User] - Job-7637458 [Log]: Message not confirmed.
2012 Feb 09 09:08:59:813 GMT +1 message.log Error [BW-Core] BWENGINE-100029 Job-7637458 Error in [SOAPRequestReply]
Activity timed out
at com.tibco.pe.core.TaskImpl.eval(Unknown Source)
at com.tibco.pe.core.Job.a(Unknown Source)
at com.tibco.pe.core.Job.k(Unknown Source)
at com.tibco.pe.core.JobDispatcher$JobCourier.a(Unknown Source)
at com.tibco.pe.core.JobDispatcher$JobCourier.run(Unknown Source)
called by: [Interface]
<?xml version="1.0" encoding="UTF-8"?>
<Data>
<ns0:ActivityTimedOutException xmlns:ns0="http://schemas.tibco.com/bw/pe/plugin/5.0/exceptions">
<msg>Activity timed out</msg>
<msgCode>BWENGINE-100029</msgCode>
</ns0:ActivityTimedOutException>
</Data>
2012 Feb 09 09:08:59:816 GMT +1 All ok
2012 Feb 09 09:12:34:828 GMT +1 message.log Error [BW_Plugin] BW-HTTP-100001 Job-7637825 Error in [SOAPRequestReply]
The Http Server replied with a 5XX status code
at com.tibco.plugin.share.http.client.JakartaHttpTransportDriver$RequestExecutor.run(Unknown Source)
at com.tibco.pe.util.ThreadPool$ThreadPoolThread.run(Unknown Source)
called by: [caller]
<?xml version="1.0" encoding="UTF-8"?>

<Data>
<ns0:HttpServerException xmlns:ns0="http://schemas.tibco.com/bw/plugins/http/5.0/httpExceptions">
<msg>The Http Server replied with a 5XX status code</msg>
<msgCode>BW-HTTP-100001</msgCode>
<ns1:statusLine xmlns:ns1="http://schemas.tibco.com/bw/plugins/http/5.0/cio">
<httpVersion>HTTP/1.1</httpVersion>
<statusCode>503</statusCode>
<reasonPhrase>Service Temporarily Unavailable</reasonPhrase>
</ns1:statusLine>
<ns1:httpMessage xmlns:ns1="http://schemas.tibco.com/bw/plugins/http/5.0/cio">
<headers>
<content-type>text/html; charset=iso-8859-1</content-type>
<connection>close</connection>
<content-length>323</content-length>
<date>Thu, 09 Feb 2012 08:12:34 GMT</date>
</headers>
<binaryContent>osdfhkfkdshgfddskghfjdgsjhgsa</binaryContent>
</ns1:httpMessage>
</ns0:HttpServerException>
</Data>

So based on your last example, what would be your desired output?

All lines, except
2012 Feb 09 09:08:59:816 GMT +1 All ok

If the line with the date time format like "2012 Feb 09 09:08:59:816 GMT +1" contains Error, include the line and all next lines until you get a line that starts with the same date time format (2012 Feb 09 09:08:59:816 GMT +1) again.

So maybe something like:

1 members found this post helpful.

It does exactly what I wanted!
Thanks mate!

Altered a bit:
awk 'BEGIN{RS = "[0-9][0-9][0-9][0-9] [A-Z][a-z][a-z] [0-3][0-9]"}/Error/{printf RT $0}' file

So next I want to (or al least try to) understand it.
RS = record separator, thats clear.
The rest is not so clear.

And how to search on "Error " Error with a space?

So simply put the space in between the slashes.

RT - this matches whatever your regex for RS is equal to ... so for me it was just 2012 but yours will be what your pattern matches.

$0 - This is the currently stored record

printf - used this so no additional new line would be added to the output

And here is a reference for all things awk:

http://www.gnu.org/software/gawk/man...ode/index.html

Thank you very much!

No problem Don't forget to mark as SOLVED once you have a solution.