linux文件内指定日期前的日志,在指定的时间范围内从日志文件中提取数据

好吧，我花了一些时间在您的日期格式上.....

但是，终于我解决了。

让我们以一个示例文件(名为logFile)为例，我做了一点简短。例如，您要在此文件中获得最近5分钟的登录信息：

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET

### lines below are what you want (5 mins till the last record)

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:30:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:30:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:30:41 +0200] "GET

172.16.0.3 - - [31/Mar/2002:19:30:41 +0200] "GET

这是解决方案：

# this variable you could customize, important is convert to seconds.

# e.g 5days=$((5*24*3600))

x=$((5*60))   #here we take 5 mins as example

# this line get the timestamp in seconds of last line of your logfile

last=$(tail -n1 logFile|awk -F'[][]' '{ gsub(/\//," ",$2); sub(/:/," ",$2); "date +%s -d \""$2"\""|getline d; print d;}' )

#this awk will give you lines you needs:

awk -F'[][]' -v last=$last -v x=$x '{ gsub(/\//," ",$2); sub(/:/," ",$2); "date +%s -d \""$2"\""|getline d; if (last-d<=x)print $0 }' logFile

输出：

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:27:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:30:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:30:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:30:41 +0200  "GET

172.16.0.3 - -  31 Mar 2002 19:30:41 +0200  "GET

编辑

您可能会注意到在输出中[和]消失了。如果您确实希望它们返回，则可以更改最后一个awk行print $0->print $1 "[" $2 "]" $3