使用命令行按 key=value 字段对日志文件进行排序
[英]Sort log file by a key=value field using command line
问题描述
I have some gigabytes of logs and I'm trying to track worst execution times of a given method, So I used grep to filter the lines that matters
我有几 GB 的日志，我正在尝试跟踪给定方法的最差执行时间，所以我使用 grep 来过滤重要的行
$ grep "m=a" /var/log/syslog*
Sep 12 05:14:00 host1[716]: 2018-09-12 05:14:00.076 [MessageBroker-2] INF 1 com.acme m=a h_status=success, h_time=51, msg=some message
Sep 11 20:00:00 host1[716]: 2018-09-11 20:00:00.389 [MessageBroker-2] INF 1 com.acme m=a h_status=success, h_time=54, msg=some message
Sep 12 04:42:00 host1[716]: 2018-09-12 04:42:00.682 [MessageBroker-2] INF 1 com.acme m=a h_status=success, h_time=77, msg=some message
Sep 12 05:15:02 host1[716]: 2018-09-12 05:15:02.536 [Test worker ] INF 2 com.acme m=a h_status=success, h_time=8, msg=some message
Now I want to sort this file in a desc order to get lines with the highest h_time field values.现在我想以降序对这个文件进行排序，以获得具有最高h_time字段值的行。 I tried to do that using sort but I have no success because I'm not getting how to extract h_time field value.我尝试使用 sort 来做到这一点，但没有成功，因为我不知道如何提取 h_time 字段值。
I searched how to use custom separators to identify custom fields using sort and foundthis and this anwser, no success.我搜索了如何使用自定义分隔符来使用排序来识别自定义字段，发现这个和这个anwser，没有成功。
How can I sort these lines in a desc order by a h_time field using some command line tool using a as simple as possible syntax?如何使用一些命令行工具使用尽可能简单的语法按 h_time 字段按降序对这些行进行排序？
1 个解决方案
解决方案1
0 2018-09-12 07:01:39
You could do something like this.你可以做这样的事情。 First use perl regex to replace and bring the numeric value at first as shown below then sort it.首先使用 perl regex 替换并首先引入数值，如下所示，然后对其进行排序。 This way you can even display only the required information.这样您甚至可以只显示所需的信息。
perl -pe 's/(.+)(h_time=\d+, )(.+)/\2\1\3/g' log | sort -V
Which gives:这使：
h_time=51, Sep 12 05:14:00 host1[716]: 2018-09-12 05:14:00.076 [MessageBroker-2] INF 1 com.acme l=35 h_status=success, msg=some message
h_time=54, Sep 11 20:00:00 host1[716]: 2018-09-11 20:00:00.389 [MessageBroker-2] INF 1 com.acme l=35 h_status=success, msg=some message
h_time=77, Sep 12 04:42:00 host1[716]: 2018-09-12 04:42:00.682 [MessageBroker-2] INF 1 com.acme l=35 h_status=success, msg=some message
h_time=8, Sep 12 05:15:02 host1[716]: 2018-09-12 05:15:02.536 [Test worker ] INF 2 com.acme l=35 h_status=success, msg=some message
Or if you want only some information:或者，如果您只想要一些信息：
perl -pe 's/(\w+ \d+ [\d:]+).+\[(.+)].+h_time=(\d+), .+/\3 ms\t\2\t\t\1/g' log | sort -V
Which gives:这使：
8 ms Test worker Sep 12 05:15:02
51 ms MessageBroker-2 Sep 12 05:14:00
54 ms MessageBroker-2 Sep 11 20:00:00
77 ms MessageBroker-2 Sep 12 04:42:00
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.