外壳工具（awk / grep / sed等），用于删除数字之后和固定标记之前的文本

Question

I have lines with the pattern

<positive_integer> <textA(which may include an integer)> | <larger_integer> <textA>

For instance:

1544 input packet chains processed with length greater than 4 | 1545 input packet chains processed with length greater than 4

I'm not sure what whitespace rules there are, may be tab or spaces there. I think the second textA will be the same as the first but maybe there is something in netstat output where that might not be true.
If it helps, I am working on the output of diff -y fileA fileB where fileA and fileB lines came from netstat -s at different times — after a bit of filtering:

Based on suggestions better filtering for me is:
netstat -s | awk '/error|length|bad|overflow|failure|dropped|loss|unknown|detect|^[[:lower:]]*:$/ { if ($1!= 0) { $1=$1; print} }'  
(keeping protocol type lines like tcp: ip:, call this the flag, which may be useful.
I hope to prepend this flag to each line (store in variables), and maybe add the
number from the line after the flag which shows the total data of that type.)

Deprecated code was: 
netstat -s | awk '{$1=$1};1' | grep -v "^0" |
grep "error\|length\|bad\|overflow\|failure\|dropped\|loss\|unknown\|detect"

I am hunting down network issues...

I'd like to get out (with a simple one-line, pipe-able, OS X command):

 1544 | 1545 input packet chains processed with length greater than 4

If it's easy and compact in the same command I'd show the data change more clearly as

 1544 > 1545 input packet chains processed with length greater than 4

This will be compact and readable in log file or on screen...

Is there a better way to get here from fileA and fileB than first diff -y ?
Or a better way to detect anomalies in my network?

My test file:

238 times recovered from bad retransmission using DSACK       | 239 times recovered from bad retransmission using DSACK
17576 dropped due to full socket buffers              | 17593 dropped due to full socket buffers
14016 with data size > data length                | 14057 with data size > data length
3609 packets for unknown/unsupported protocol             | 3610 packets for unknown/unsupported protocol
13562 packets received for unknown multicast group        | 13571 packets received for unknown multicast group
4909 input packet chains processed with length greater than 2 | 4911 input packet chains processed with length greater than 2
1544 input packet chains processed with length greater than 4 | 1545 input packet chains processed with length greater than 4
1473 message too big failures                     | 1481 message too big failures
13 send failures                          | 17 send failures

Answer 1

You could use the command

$ sed -e 's/\([0-9][0-9]*\).*|/\1 |/' < input-file

If input-file contains

1544 input packet chains processed with length greater than 4 | 1545 input packet chains processed with length greater than 4

what you get out will be

1544 | 1545 input packet chains processed with length greater than 4

Answer 2

Thanks to inspiration to try this route from awk (above) I have reduced and added to the magic incantations until... tan-tat-ta-TA-taraaa: sed 's/\\([0-9]*\\)[^|]*|/\\1 >/'
I think .* is greedy and runs to line end.
repeated not | works [^|]*
And I have built in my change of | to > for nice formatting my test file rendering as:

238 > 239 times recovered from bad retransmission using DSACK
17576 > 17593 dropped due to full socket buffers
14016 > 14057 with data size > data length
3609 >  3610 packets for unknown/unsupported protocol
13562 > 13571 packets received for unknown multicast group
4909 >  4911 input packet chains processed with length greater than 2
1544 >  1545 input packet chains processed with length greater than 4
1473 >  1481 message too big failures
13 >    17 send failures

Pretty enough for me! Could not manage to insert a tab char before the >...