使用Sed替换日志中的字符串

Question

I have access log like:

10.2.21.120 - - [26/Jan/2013:19:15:11 +0000] "GET /index.html HTTP/1.1" 200 6 "-" "Mozilla/0.0 (X11; Linux x86_64) AppleWebKit/000.00 (KHTML, like Gecko) Chrome/0.0.0000.00 Safari/000.00"

I want to replace the user-agent. Resulting:

10.2.21.120 - - [26/Jan/2013:19:15:11 +0000] "GET /index.html HTTP/1.1" 200 6 "-" "NetScape"

I try to change all after "-" but Sed skips "" and change all after -

something like this sed 's/[(][^)]*[)]/\\(NetScape\\)/g' input` change user-agent only in brackets

Answer 1

Using sed , you may replace the substring between quotes at the end of the line:

sed 's/"[^"]*"$/"NetScape"/'

Here, "[^"]*"$ matches " , then 0+ chars other than " and then a " at the end of the line. You do not need the g operator since sed processes files line by line.

See the online sed demo :

log='10.2.21.120 - - [26/Jan/2013:19:15:11 +0000] "GET /index.html HTTP/1.1" 200 6 "-" "Mozilla/0.0 (X11; Linux x86_64) AppleWebKit/000.00 (KHTML, like Gecko) Chrome/0.0.0000.00 Safari/000.00"'
sed 's/"[^"]*"$/"NetScape"/' <<< "$log"
# => 10.2.21.120 - - [26/Jan/2013:19:15:11 +0000] "GET /index.html HTTP/1.1" 200 6 "-" "NetScape"