CODEWITHSUNDEEP
bashawksed
lotusnoir
lotusnoir

Reputation: 57

grep 2 elements in a line and print them

Here is my issue, i have a file with the entries, i would like to get just the date + the last command after the last "]: "

Aug 17 14:25:17 snaper[22134]: [ip:10.1.15.245 37985 10.1.15.18 22 uid:10000 sid:21680 tty: cwd:/data/www/hybris/hybris/bin/platform filename:/bin/ps]: /bin/ps -p 6763

How can i get it when i cat the file ?

I can get the date with:

awk '{print $1,$2,$3}'

and the last command with :

awk -F': ' '{print $NF}'

But how to combine them to get it in a single line ? I'm not awk limited, any sed grep or other command is ok for me :) Thanks in advance

Upvotes: 1

Views: 420

Answers (6)

RavinderSingh13
RavinderSingh13

Reputation: 133428

Try following solutions too. Considering your Input_file will be having same data as shown sample.

Solution 1st: Using simple cut command.

cut -d" " -f1,2,3,14,15,16  Input_file

Solution 2nd: using awk command where I am making string snaper and ]: as field separators.

awk -F' snaper|]:' '{print $1,$4}'  Input_file

Solution 3rd: making record separator as space and then printing only those lines which we need as per OP's request.

awk -v RS=" " 'NR<4||NR>13{printf("%s%s",$0,NR<3||NR<16?" ":"")}' Input_file

Solution 4th: Substituting everything from snap to till : and get whatever is OP's request.

awk '{sub(/snaper\[.*\]: /,"");print}'  Input_file

Solution 5th: Using --re-interval here(as I have old version of awk) you could remove it if you latest awk version in your system too.

awk --re-interval '{match($0,/.*[0-9]{2}:[0-9]{2}:[0-9]{2}/);print substr($0,RSTART,RLENGTH),$(NF-2),$(NF-1),$NF}'  Input_file

Solution 6th: using sed and substituting everything till snaper and then everything till colon and printing the match only.

sed 's/\(.[^s]*\)\(.*:\)\(.*\)/\1\3/'   Input_file

Upvotes: 0

CWLiu
CWLiu

Reputation: 4043

$ s="Aug 17 14:25:17 snaper[22134]: [ip:10.1.15.245 37985 10.1.15.18 22 uid:10000 sid:21680 tty: cwd:/data/www/hybris/hybris/bin/platform filename:/bin/ps]: /bin/ps -p 6763"

Use sed to achieve your goal,

$ sed -r 's/(^.*:[0-9]{2}) .*]:/\1/' <<< "$s"

Upvotes: 0

beliy
beliy

Reputation: 445

Possible use tee for use 1 output to 2 commands:

echo 'Aug 17 14:25:17 snaper[22134]: [ip:10.1.15.245 37985 10.1.15.18 22 uid:10000 sid:21680 tty: cwd:/data/www/hybris/hybris/bin/platform filename:/bin/ps]: /bin/ps -p 6763' | tee >(awk -F': ' '{print $NF}') | awk '{print $1,$2,$3}' | tr '\n' ' '

and we have output as:

Aug 17 14:25:17 /bin/ps -p 6763

Upvotes: 0

glenn jackman
glenn jackman

Reputation: 246744

Using GNU grep

grep -oP '^.{15}|.*\]: \K.*' file | paste - -

Upvotes: 0

nagendra547
nagendra547

Reputation: 6302

Simple solution using AWK

$awk '{print $1,$2,$3,  $(NF-2), $(NF-1), $NF }' file
Aug 17 14:25:17 /bin/ps -p 6763

Upvotes: 0

choroba
choroba

Reputation: 241768

Just remove everything between the date and the last command:

sed 's/^\(... .. ..:..:..\).*: /\1 /'

Upvotes: 5

Related Questions