拡張grepとしてのawk。awkを使ってログを抽出する

gistfile1.md

3番目の値と等価な行のみを抽出

%cat development.log | awk '$3=="OK"'

Completed 200 OK in 3412ms (Views: 3411.8ms | ActiveRecord: 0.0ms)
Completed 200 OK in 17ms (Views: 16.6ms | ActiveRecord: 0.0ms)
Completed 200 OK in 177ms (Views: 176.3ms | ActiveRecord: 0.0ms)
Completed 200 OK in 254ms (Views: 14.5ms | ActiveRecord: 108.4ms)

正規表現で抽出

%cat development.log | awk '$3~/blogs/'

Started GET "/blogs" for 127.0.0.1 at 2012-09-09 23:06:49 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:06:51 +0900
Started GET "/blogs" for 127.0.0.1 at 2012-09-09 23:07:47 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:07:49 +0900
Started GET "/blogs/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:07:50 +0900
Started GET "/blogs/1/edit" for 127.0.0.1 at 2012-09-09 23:09:51 +0900
Started GET "/blogs/1/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:09:53 +0900
Started POST "/blogs/1" for 127.0.0.1 at 2012-09-09 23:10:39 +0900
Started POST "/blogs/1/edit" for 127.0.0.1 at 2012-09-09 23:10:56 +0900
Started GET "/blogs/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:11:03 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:11:03 +0900
Started GET "/blogs/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:11:04 +0900
Started GET "/blogs/1/edit" for 127.0.0.1 at 2012-09-09 23:11:27 +0900
Started GET "/blogs/1/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:11:29 +0900
Started POST "/blogs/1" for 127.0.0.1 at 2012-09-09 23:12:01 +0900
Started POST "/blogs/1-X" for 127.0.0.1 at 2012-09-09 23:12:06 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:12:19 +0900

正規表現と2番目の値がGETであるもののみを抽出

%cat development.log | awk '$3~/blogs/ && $2="GET"'

Started GET "/blogs" for 127.0.0.1 at 2012-09-09 23:06:49 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:06:51 +0900
Started GET "/blogs" for 127.0.0.1 at 2012-09-09 23:07:47 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:07:49 +0900
Started GET "/blogs/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:07:50 +0900
Started GET "/blogs/1/edit" for 127.0.0.1 at 2012-09-09 23:09:51 +0900
Started GET "/blogs/1/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:09:53 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:10:39 +0900
Started GET "/blogs/1/edit" for 127.0.0.1 at 2012-09-09 23:10:56 +0900
Started GET "/blogs/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:11:03 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:11:03 +0900
Started GET "/blogs/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:11:04 +0900
Started GET "/blogs/1/edit" for 127.0.0.1 at 2012-09-09 23:11:27 +0900
Started GET "/blogs/1/images/favicon.ico" for 127.0.0.1 at 2012-09-09 23:11:29 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:12:01 +0900
Started GET "/blogs/1-X" for 127.0.0.1 at 2012-09-09 23:12:06 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:12:19 +0900

パイプしてさらに抽出する、8番目の値が23:12:00以上の行を抽出

%cat development.log | awk '$3~/blogs/ && $2="GET"' | awk '$8>="23:12:00"'

Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:12:01 +0900
Started GET "/blogs/1-X" for 127.0.0.1 at 2012-09-09 23:12:06 +0900
Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:12:19 +0900

3番目の値を正規表現抽出と2番目の値がGETであるもののみを抽出、8番目の値が23:12:00以上で23:12:10より小さい行を抽出

%cat development.log | awk '$3~/blogs/ && $2="GET"' | awk '$8>="23:12:00" && $8<"23:12:10"'

Started GET "/blogs/1" for 127.0.0.1 at 2012-09-09 23:12:01 +0900
Started GET "/blogs/1-X" for 127.0.0.1 at 2012-09-09 23:12:06 +0900