1. 基本语法
awk的变量不需要声明可以直接使用 awk的变量没有固定的类型
{...} 代表 awk 中的块
BEGIN{...} 在 程序的开始执行 相当于 init
END{...} 在 程序的最后执行 相当于 finally
awk 可以使用隐式的字符串连接
比如: "a""b""c" == "abc" a="ab";c="c"; a" "c=="ab c"; a""c=="abc"
$[第几个匹配项] 使用 FS 或-F 进行分割 , 默认为 空白字符 (- $0 整个匹配项 $1 第一个
sub函数
sub(pattern,repalce_value,source_string) 直接把匹配的更新为 source_string 例如: 2007-09-28 09:43:21 INFO Thread-29 4 return code:701 $7 == code:701 $2 == 09:43:21 1、sub(/^code:/,"",$6); $6 == 701 2、sub(/.[^:]+.[^:]+$/,"",$2); $2 == 09
假如分析日志test.log里内容:
- 2007-09-28 10:55:44 INFO http://px688.blog.163.com/rss/ return code:700
- 2007-09-28 10:55:44 INFO http://www.aaa.com return code:304
- 2007-09-28 10:55:44 INFO http://insraq.org/rss.xml return code:701
- 2007-09-28 10:55:44 INFO http://netdrr.yo2.cn/feed/ return code:700
- 2007-09-28 10:55:45 INFO http://www.sysnail.cn/feed/ return code:304
- 2007-09-28 10:55:45 INFO http://blog.a.com.cn/myog/index_rss return code:700
- 2007-09-28 10:55:45 INFO http://blog.sa.com.cn/rss/afish.xml return code:304
- 2007-09-28 10:55:45 INFO http://blog.sna.com.cn/myblog return code:304
1. 显示test.log的所有行的第2列(默认以空格分割)
cpp 代码
- awk '{print $2}' test.log
- 输出值:
- 10:55:44
- 10:55:44
- 10:55:44
- 10:55:44
- 10:55:45
- 10:55:45
- 10:55:45
- 10:55:45
默认是以空格分割,可以自己定义:用FS或-F自定义
比如以冒号(:)分割:
cpp 代码
- awk -F: '{print $1}' test.log
- 输出为:
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 或者
- awk 'BEGIN{FS=":"} {print $1}' test.log
- 输出为:
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
- 2007-09-28 10
2. 显示test.log里以空格分割出来的第2个字符串是“
cpp 代码
- awk '$2 ~ /^10:55:45$/ {print $0}' test.log
- 输出为:
- 2007-09-28 10:55:45 INFO http://www.sysnail.cn/feed/ return code:304
- 2007-09-28 10:55:45 INFO http://blog.a.com.cn/myog/index_rss return code:700
- 2007-09-28 10:55:45 INFO http://blog.sa.com.cn/rss/afish.xml return code:304
- 2007-09-28 10:55:45 INFO http://blog.sna.com.cn/myblog return code:304
3. 统计某个小时内return code各个状态码的个数
java 代码
- awk '{sub("^code:","",$6);sub(".[^:]+.[^:]+$","",$2);if($2){a[$2" "$6]++;} }END{for(i in a){print i" "a[i];}}' test.log
- 或者
- awk '{sub(/^code:/,"",$6);sub(/.[^:]+.[^:]+$/,"",$2);if($2){a[$2" "$6]++;} }END{for(i in a){print i" "a[i];}}' test.log
- 输出结果为:
- 10 304 4
- 10 700 3
- 10 701 1
4.awk '$13~/^code:/{sub(/^code:/,"",$13);sub(/.[^:]+.[^:]+$/,"",$2);if($2){a[$2" "$13]++;} }END{for(i in a){if(i~/^01/){print i" "a[i];}}}' test.log