我有一个搜索算法,可以解析日志文件并将结果放入以下格式:
[Mon May 2 13:46:00 2016]Local/ESSBASE///139969058175296/Info(4052237)
Logging out user [accelatisro@Native Directory], active for 0 minutes
--
[Mon May 2 13:46:00 2016]Local/ESSBASE///139969068702016/Info(4052237)
Logging out user [accelatisro@Native Directory], active for 4 minutes
--
[Mon May 2 13:46:01 2016]Local/ESSBASE///139969078176064/Info(4052237)
Logging out user [accelatisro@Native Directory], active for 6 minutes
--
[Mon May 2 13:46:01 2016]Local/ESSBASE///69062385984/Info(4052237)
Logging out user [accelatisro@Native Directory], active for 45 minutes
--
[Mon May 2 13:46:01 2016]Local/ESSBASE///69160071488/Info(4052237)
Logging out user [accelatisro@Native Directory], active for 3 minutes
--
[Mon May 2 13:46:02 2016]Local/ESSBASE///969053964608/Info(4052237)
Logging out user [accelatisro@Native Directory], active for 3 minutes
我需要获取日期(IE:5-2-2016 13:46:02)、注销的用户(IE:accelatisro@Native Directory)以及他们活跃的分钟数(IE:45)。然后我需要将结果写入逗号分隔的格式,以便我可以将信息上传到数据库(IE:5-2-2016 13:46:02,accelatisro@Native Directory,45)。该文件大约有 45,000 行长,因此无法手动完成。
我应该采取什么方法来解决这个问题?
最佳答案
简单的方法是为您可能需要匹配的每一行编写正则表达式,然后迭代文件,填充每个匹配行的数据,并在看到记录分隔符时发出该数据。例如:
#!/bin/bash
l1_re='^\[([^\]+)]'
l2_re='Logging out user \[([^\]+)], active for ([[:digit:]]+) minutes'
delim='--'
flush() {
[[ $time && $user && $minutes ]] || return
printf '%s,%s,%s\n' "${time//,/}" "${user//,/}" "${minutes//,/}"
time=; user=; minutes=
}
while IFS= read -r line; do
if [[ $line =~ $l1_re ]]; then
time=${BASH_REMATCH[1]}
elif [[ $line =~ $l2_re ]]; then
user=${BASH_REMATCH[1]}
minutes=${BASH_REMATCH[2]}
elif [[ $line = $delim ]]; then
flush
fi
done
flush
根据您给定的输入,会发出:
Mon May 2 13:46:00 2016,accelatisro@Native Directory,0
Mon May 2 13:46:00 2016,accelatisro@Native Directory,4
Mon May 2 13:46:01 2016,accelatisro@Native Directory,6
Mon May 2 13:46:01 2016,accelatisro@Native Directory,45
Mon May 2 13:46:01 2016,accelatisro@Native Directory,3
Mon May 2 13:46:02 2016,accelatisro@Native Directory,3
关于linux - 将多行记录的日志文件中的数据提取到 CSV,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/37033344/