shell查询error日志，高效版

之前写过shell查询某时间段的error日志脚本

对于较长的log，之前的shell脚本查询效率较低（因为循环了log的每一行来做查询）

下面是高效版的shell查询error日志

#!/bin/sh

select_dir=$1
input_time=$2
if [[ "${input_time}" =~ 'd' ]]; then
    se_time="$(echo "${input_time}" | grep -Po "[0-9]+") days"
elif [[ "${input_time}" =~ 'h' ]]; then
    se_time="$(echo "${input_time}" | grep -Po "[0-9]+") hours"
elif [[ "${input_time}" =~ 'm' ]]; then
    se_time="$(echo "${input_time}" | grep -Po "[0-9]+") minutes"
fi
sed -i '1,$d' error.log
time_format='[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}'
now_date=`date "+%Y-%m-%d %H:%M:%S"`
find_date=`date -d "${se_time} ago" "+%Y-%m-%d %H:%M:%S"`
#find_date=`date -d "20 days ago" "+%Y-%m-%d %H:%M:%S"`
echo "find time is ${find_date}"
for log in `find ./${select_dir} -name '*.log'`; do
    echo ${log}
    echo ${log} >> error.log
    error_data=$(cat ${log} | grep -C 20 -E "ERROR|Error")
    error_line=$(echo "${error_data}" | grep -E "ERROR|Error" | head -1)
   # echo ${error_line}
    time=$(echo "${error_line}" | grep -Po "${time_format}")
   # echo ${time}
    if [[ "${time}" > "${find_date}" ]] && [[ "${time}" < "${now_date}" ]]; then 
        echo "${error_data}" >> error.log
    fi
    echo ' ' >> error.log
done
echo 'end'

使用说明，参见之前的博客

https://blog.csdn.net/Misaki_root/article/details/92630954