[SOLVED] Filter a log to only the lines between two patterns

pingu · 02-26-2015, 09:43 AM

Both awk and sed can do this, but everything tried outputs nothing.
So, I have a huge log file from which I need to extract all events for a specific day.
Start pattern: "Tue Feb 24"
End pattern: "Wed Feb 25"

I used 'grep' to get the line numbers for start/end pattern like so:

Code:

grep -n "Tue Feb 24" /var/log/logfile.log |less 
grep -n "Wed Feb 26" /var/log/logfile.log |less

This now works, I can actually get the content:
sed '29694592,29897297!d' /var/log/logfile.log |wc -l
202706

Of course I could be satisfied by this, but I know it can be done with a simple one-liner - I just can't get it right.
Here is what I've tried, none of them outputs anything:

Code:

awk '/"Tue Feb 24"/ { show=1 } show; /"Wed Feb 25"/ { show=0 }' /var/log/logfile.log
awk '/"Tue Feb 24"/,/"Wed Feb 25"/' /var/log/logfile.log

sed -n '/"Tue Feb 24"/,/"Wed Feb 25"/p' /var/log/logfile.log
sed -n -e '/"Tue Feb 24"/,/"Wed Feb 25"/p' /var/log/logfile.log
sed '/"Tue Feb 24"/,/"Wed Feb 25"/!d' /var/log/logfile.log
sed -e '/"Tue Feb 24"/,/"Wed Feb 25"/!d' /var/log/logfile.log

Extract from logfile, the line with date:
<log realm="RemoteServer" at="Tue Dec 02 01:32:19 CET 2014.599">

allend · 02-27-2015, 09:11 AM

I came up with this after adapting from an earlier post http://www.linuxquestions.org/questi...0/#post5133189

Code:

awk '{split($6,t,":");split($8,y,".");e=mktime(y[1]" 12 "$5" "t[1]" "t[2]" "t[3]); if (e>mktime("2014 12 01 23 59 59") && e<=mktime("2014 12 03 0 0 0")) print $0}' logfile.txt

I have cheated by hardcoding the month as a numeral (as shown in bold) rather than converting the month string.
With this input

Quote:

I get this output

Quote:

Turbocapitalist · 03-02-2015, 11:16 AM

The double quotes get in the way if they are not present in the log file itself.

Code:

sed -e '/^Tue Feb 24/,/^Wed Feb 25/!d' /var/log/logfile.log

There sed looks for the string literals when they occur at the start of the line. If you are looking for somewhere else on the line, then remove the carets.

pingu · 03-10-2015, 06:59 AM

Yes, of course, the single quotes shouldn't be there! How could I miss that!
Thanks a lot!