CODEWITHSUNDEEP
regexbashsedawk
Evil Genius
Evil Genius

Reputation: 1055

use sed to replace the regex match & the line before the match with a "-=+ REMOVED +=-"

I have a large, and I mean large log of over 1.9 million lines. I need to regex to replace all lines that do not contain the word "Never" and the preceding line and then replace with -=+ REMOVED +=-. bellow is an example from the log. 

2013-09-17-01:02:43 User: [email protected]  
2013-09-17-01:02:43 Last login time: Never  
2013-09-17-01:02:43 User: [email protected]  
2013-09-17-01:02:43 Last login time: 2013-09-16  
2013-09-17-01:02:43 User: [email protected]  
2013-09-17-01:02:43 Last login time: 2013-09-15

SO the user has a login time, remove the line and the line prior for the email address. Final output should look like

2013-09-17-01:02:43 User: [email protected]  
2013-09-17-01:02:43 Last login time: Never  
-=+ REMOVED +=-  
-=+ REMOVED +=-  
-=+ REMOVED +=-  
-=+ REMOVED +=-

Should be easy, but I have been beating my brains on it for the last hour.

I would prefer to use sed as I am trying to learn more, but am open to anything...

Upvotes: 1

Views: 2471

Answers (3)

potong
potong

Reputation: 58381

This might work for you (GNU sed):

 sed '$!N;/\n.*Never/!s/.*/-=+ REMOVED +=-/mg'  file

Upvotes: 5

Jotne
Jotne

Reputation: 41456

Another awk

awk '/User:/ {u=$0} /Last/ {if (/Never/) {print u"\n"$0} else {print v"\n"v}}' v="-=+ REMOVED +=-" file

Upvotes: 0

fedorqui
fedorqui

Reputation: 289565

This can make it:

$ rm="-=+ REMOVED +=-"
$ awk -v rm="$rm" 'BEGIN{OFS="\n"}NR%2{a=$0; next} $0~/Never/ {print a,$0; next}{print rm,rm}' a
2013-09-17-01:02:43 User: [email protected]  
2013-09-17-01:02:43 Last login time: Never  
-=+ REMOVED +=-
-=+ REMOVED +=-
-=+ REMOVED +=-
-=+ REMOVED +=-

Explanation

  • -v rm="$rm" is used to store the "removed" text.
  • BEGIN{OFS="\n"} defines the lines separator.
  • NR%2{a=$0; next} in case of odd line, store the line in the a var. $0~/Never/ {print a,$0; next}{print rm,rm}'in case the line contains "Never", print the previous line (stored inaand the current one). Otherwise, printremoved` text twice.

Upvotes: 1

Related Questions