- 论坛徽章:
- 2
|
nginx的日志么?
最近刚写过处理代码,只要看time那一段处理就行了
cat ${tmpsrcfile}|awk -F'\\|\\|' '
BEGIN{_time_="";_ip_="";_name_="";_byte_="";_rst_="";_lastLineTime_="";_lastLineCol1=""}
{
if($8~/\.apk /)
{
if(match($1,"time=")>0) _time_=substr($1,index($1,"time=")+5);
if(match($2,"remote_addr=")>0) _ip_=substr($2,index($2,"remote_addr=")+12);
if(match($8,"request=GET ")>0) _name_=substr($8,index($8,"request=GET ")+12);
if(match($7,"body_bytes=")>0) _byte_=substr($7,index($7,"body_bytes=")+11);
if(match($9,"status=")>0) _rst_=substr($9,index($9,"status=")+7);
if($1!=_lastLineCol1)
{
if(_time_&&_time_!=" ")
{
split(_time_,_arrTime_,"[/: ]");
_time_=_arrTime_[2]" "_arrTime_[1]" "_arrTime_[4]":"_arrTime_[5]":"_arrTime_[6]" "_arrTime_[3];
"export Lang=utf-8;date -d \""_time_"\" +%Y%m%d%H%M%S"|getline _time_
_lastLineTime_=_time_
_lastLineCol1=$1
}
}
else
{
_time_=_lastLineTime_
};
if(_ip_&&_ip_!=" ")
{
gsub(/ /,"",_ip_)
};
if(_name_&&_name_!=" ")
{
split(_name_,_arrName_," ");
split(_arrName_[1],_arrName2_,"/");
_name_=_arrName2_[length(_arrName2_)]
};
if(_byte_&&_byte_!=" ")
{
gsub(/ /,"",_byte_)
};
if(_rst_&&_rst_!=" ")
{
gsub(/ /,"",_rst_)
};
printf "%s|#%s|#%s|#%s|#%s\n",_time_,_ip_,_name_,_byte_,_rst_;
}
}' |
|