Question

我一直在使用awk命令

添加XML标记来代理错误日志

awk ‘{ print “<record><data name=\”F1\” <value>=\””$1”\”/><data name=\”F2\” <value>=\””$2”\”/><data name=\”F3\” <value>=\””$3”\”/>; for ( i=4; i<=NF; i++ ) {printf “%s “, $i}; print (“\””); printf (“\n”) }’

每个日志条目由＆＃34; TIMESTAMP＆＃34;组成。＆＃34;日志优先＆＃34; ＆＃34; UID＆＃34; ＆＃34; MESSAGE＆＃34; 并且每5分钟轮换一次，此代码针对旋转的日志运行。

今天我开始获取多行日志条目，这些条目需要转换为格式为

的单行条目

[16/Mar/2015:10:34:12] Security(29264):
        [CLIENT4330] HTTP5094: while trying to get attribute “user”
        [CLIENT4330] HTTP5094: while trying to get attribute “invalid-password”
        [CLIENT4330] HTTP5094: ldap password check: LDAP error:
[16/Mar/2015:10:34:12] <Next Log entry>
[16/Mar/2015:10:34:12] <Next Log entry>

我一直在尝试研究如何捕获多行日志条目并将它们连接到附加到时间戳的单个行条目中。缩进是8个空格。

此代码在Solaris 10实例上运行，我无法添加除默认安装之外的任何其他软件或模块。

由于

Answer 1

如果行未以[

开头，则会将所有日志转换回单行

awk '{printf "%s",(/^\[/?RS $0:$0)}' file

[16/Mar/2015:10:34:12] Security(29264):        [CLIENT4330] HTTP5094: while trying to get attribute .user.        [CLIENT4330] HTTP5094: while trying to get attribute .invalid-password.        [CLIENT4330] HTTP5094: ldap password check: LDAP error:
[16/Mar/2015:10:34:12] <Next Log entry>
[16/Mar/2015:10:34:12] <Next Log entry>

如果你想摆脱第一个空行并在最后得到一个新行，请使用：

awk '{printf "%s",(/^\[/ && NR>1?RS $0:$0)} END {print ""}' t
[16/Mar/2015:10:34:12] Security(29264):        [CLIENT4330] HTTP5094: while trying to get attribute .user.        [CLIENT4330] HTTP5094: while trying to get attribute .invalid-password.        [CLIENT4330] HTTP5094: ldap password check: LDAP error:
[16/Mar/2015:10:34:12] <Next Log entry>
[16/Mar/2015:10:34:12] <Next Log entry>

如果需要，还可以修剪额外的空间。

将多行日志条目处理为单行

1 个答案: