query text content
sample text
1.001 08:07:49 192.168.1.1 timeout fore webserver/server01 200 120
2.002 08:07:49 192.168.1.1 timeout fo webserver/server01 200 230
3.003 08:38:49 192.168.1.1 timeout for webserver/server02 404 340
4.004 08:49:49 192.168.1.5 timeout for webserver/server02 503 450
5.005 09:01:49 192.168.1.9 timexxx for webserver/server02 504 560
intercept
1.cat t.log |awk '{print $(NF-1)}' #The default space is the delimiter, and the penultimate field is intercepted
2.cat t.log |awk -F' |/' '{print $7}' #Space or / as a separator to intercept
3.cat t.log |awk 'BEGIN{FS=" |/"}{print $7}' #Same as above
4.cat t.log |awk -F"webserver/" '{print $2}' #Keywords are intercepted as separators
match & compare
1.cat t.log |awk '{if ($5 ~ /for/) print $0}' #包含 1,3,4,5
2.cat t.log |awk '{if ($5 !~ /for/) print $0}' #does not contain 2
3.cat t.log |awk '{if ($5 = "for") print $0}' #replace (display)
4.cat t.log |awk '{if ($5 == "for") print $0}' #等于 3,4,5
5.cat t.log |awk '{if ($5 != "for") print $0}' #Not equal to 1,2
6.cat t.log |awk '{if ($2 ~ /08:0[0-9]/) print }' #Regular match, the second field time is 8:00-8:09 1,2
7.cat t.log |awk '{if ($7==200 && $NF<150) print }' #And, the seventh field is equal to 200 and the last field is less than 150 1
8.cat t.log |awk '{if ($7==503||$7==504) print}' #Or, the first column is equal to 503 or 504 4,5
9.cat t.log|awk '!a[$3]++' #De-duplication, the third column is key to de-duplicate 1,4,5
Operations & Statistics
1.cat t.log |awk 'BEGIN{sum=0}{sum+=$8}END{print sum}' #Sum, the sixth column sum is 1700
2.cat t.log |awk 'BEGIN{sum=0;num=0}{sum+=$8;num+=1}END{print "avg:" sum/num}' #Average, find column average 340
3.cat t.log |awk '{ii[$3]++}END{for (i in ii){print ii[i],i}}' #Count the number of times, the third field is the number of key occurrences
4.cat t.log |awk '{s+=gsub(/timeout/,"&")}END{print s,"timeout"}' #Count the times, count the occurrences of the keyword timeout string 4 timeout
5.
1. #Judgment, Regularity, Statistics, Array
2. #$11 is not a three-digit number, and then count the number of occurrences
3.cat ha.log-20150322 |awk --posix '
4.{if ($11 !~ /[[:digit:]]{3}/) ii[$11]++}
5.END{for (i in ii) print ii[i],i}
6.'