Parsing a log file

jpostma · 12-05-2008, 03:00 PM

Hi,

I have a big log file (access.log). I'm only interested in the lines that contains the words '404' and 'class' (both in the same line). How can I create a new file with only these log lines?

Johannes

arckane · 12-05-2008, 03:12 PM

Easy way if you're not worried about the sorting of the file:

grep 404 access.log > /tmp/parsed.txt && grep class access.log >> /tmp/parsed.txt

jpostma · 12-05-2008, 03:15 PM

Thank you!

arckane · 12-05-2008, 03:24 PM

Actually, that was terrible advice. Pattern match will be quicker:

Code:

grep "404\|cron" access.log > /tmp/newfile.txt

Sorry, not wearing my admin hat this evening.

anomie · 12-05-2008, 03:31 PM

If I'm reading correctly, he only wants a match where both '404' and 'class' are on the same line.

In that case I would use something like:
%cat access.log | grep '404' | grep 'class' > output.txt

Tinkster · 12-05-2008, 03:58 PM

Or to save oneself two invocations of grep and the cat:

Code:

awk '/404/ && /class/' access.log > extract

Oh, and if the two patterns are always in the
same order a simpler one-grep approach would
also work, it they're not a slightly lengthier
(and uglier) solution using one grep could be found.

Code:

grep "404.*class" access.log > extract
egrep "(404.*class|class.*404)" access.log > extract

Personally I find the awk solution cleanest ... ;)

Cheers,
Tink