使用awk找到日志中超时的行记录

生产上的日志较大，刷新很快，希望利用awk快速找到交易超时的那部分，日志输出格式如下(日志名称为mca_controller.log)，每行日志的元素使用竖划线|分割，第五个元素是响应时间，后面带时间的单位秒。

2018-11-09 22:49:00|aaa|111|mca_controller|0.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|222|mca_controller|2.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|333|mca_controller|3.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|444|mca_controller|4.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|555|mca_controller|23.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|666|mca_controller|45.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|777|mca_controller|1.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|888|mca_controller|6.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|999|mca_controller|11.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|aaa|mca_controller|1.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|bbb|mca_controller|25.25s||2323423|23423|23
2018-11-09 22:49:00|aaa|ccc|mca_controller|133.25s||2323423|23423|23

处理思路：1、先使用awk按照竖线|分割; 

awk -F "|" '{print $5}' mca_controller.log

2、第五个元素是时间带单位，再对其按小数点分割；

awk -F "|" '{split($5,a,".");print a[1]}' mca_controller.log

3、对分割后的时间进行判断，如果大于某个时间才输出

 3.1、实时刷新满足条件的日志

tail -200f mca_controller.log |awk -F  "|" '{split($5,a,"."); if(a[1]>=3) print NR "\t" $0}'

 3.2、搜索日志输出满足条件的日志

awk -F "|" '{split($5,a,"."); if(a[1]>=3) print NR "\t" $0}' mca_controller.log

---

awk命令详解：https://www.cnblogs.com/xudong-bupt/p/3721210.html

awk入门指南：https://awk.readthedocs.io/en/latest/chapter-one.html