nginx日志的提取

changsiheng

100.0.0.16 - - [27/Aug/2015:10:44:58 +0000] GET www HTTP/1.1 "200" 15 "-" "-" "-" "3.254" "192.168.1.1:80"

100.0.1.13 - - [27/Aug/2015:10:45:22 +0000] GET www HTTP/1.1 "200" 90 "-" "-" "-" "0.498" "192.168.1.1:80"

100.0.1.13 - - [27/Aug/2015:10:46:26 +0000] GET www HTTP/1.1 "200" 90 "-" "-" "-" "1.704" "192.168.1.1:80"

100.0.1.16 - - [27/Aug/2015:10:46:35 +0000] GET www HTTP/1.1 "200" 94 "-" "-" "-" "1.189" "192.168.1.1:80"

统计非200的数量


各位好，我想提取2015:10:44:00到2015:10:49:00，五分钟內的访问状态，这个语句应当如何操作



awk '$4 ~ '/*$start_time*/','/*$end_time*/' {print $0}' $logfile

本想说提取出时间先，但是发现时间我都提取不出来，真心求解，先谢谢各位了

MMMIX

回复 1# changsiheng


    恰当的分割加判断即可：

awk -vstart='2015:10:40:00' -vend='2015:10:50:00'  -F'/|\\s+|\\s*"\\s*' ' start <= $6 && $6 <= end && $12 != 200 '

tuyajie

1. [jay.liu@aliCloud chinaUnix]$ awk -F'[/: \"]' '{print $6,$7,$8,$9,$16}' test.dat
   
2. 2015 10 44 58 200
   
3. 2015 10 45 22 200
   
4. 2015 10 46 26 200
   
5. 2015 10 46 35 200
   
6. [jay.liu@aliCloud chinaUnix]$ cat test.dat
   
7. 100.0.0.16 - - [27/Aug/2015:10:44:58 +0000] GET www HTTP/1.1 "200" 15 "-" "-" "-" "3.254" "192.168.1.1:80"
   
8. 100.0.1.13 - - [27/Aug/2015:10:45:22 +0000] GET www HTTP/1.1 "200" 90 "-" "-" "-" "0.498" "192.168.1.1:80"
   
9. 100.0.1.13 - - [27/Aug/2015:10:46:26 +0000] GET www HTTP/1.1 "200" 90 "-" "-" "-" "1.704" "192.168.1.1:80"
   
10. 100.0.1.16 - - [27/Aug/2015:10:46:35 +0000] GET www HTTP/1.1 "200" 94 "-" "-" "-" "1.189" "192.168.1.1:80"

复制代码

再根据需求加工加工吧

bikong0411

1. awk -F'[/ "]' '$6>="2015:10:44:00" && $6<="2015:10:49:00" && $13 != 200'

复制代码

jason680

回复 1# changsiheng

$ start_time="10:44:00"; end_time="10:46:00";awk -vst="$start_time" -vet="$end_time" '{t=$4;gsub(/^[^:]+:/,"",t);if(st<=t&&t<=et)print}' FILE
100.0.0.16 - - [27/Aug/2015:10:44:58 +0000] GET www HTTP/1.1 "200" 15 "-" "-" "-" "3.254" "192.168.1.1:80"
100.0.1.13 - - [27/Aug/2015:10:45:22 +0000] GET www HTTP/1.1 "200" 90 "-" "-" "-" "0.498" "192.168.1.1:80"

$ start_time="10:44:00"; end_time="10:49:00";awk -vst="$start_time" -vet="$end_time" '{t=$4;gsub(/^[^:]+:/,"",t);if(st<=t&&t<=et)print}' FILE
100.0.0.16 - - [27/Aug/2015:10:44:58 +0000] GET www HTTP/1.1 "200" 15 "-" "-" "-" "3.254" "192.168.1.1:80"
100.0.1.13 - - [27/Aug/2015:10:45:22 +0000] GET www HTTP/1.1 "200" 90 "-" "-" "-" "0.498" "192.168.1.1:80"
100.0.1.13 - - [27/Aug/2015:10:46:26 +0000] GET www HTTP/1.1 "200" 90 "-" "-" "-" "1.704" "192.168.1.1:80"
100.0.1.16 - - [27/Aug/2015:10:46:35 +0000] GET www HTTP/1.1 "200" 94 "-" "-" "-" "1.189" "192.168.1.1:80"

   

changsiheng

确实如您所说，之前可能是太着急，并且对日志结构也不是很明白，这上午又重新写了一下，算是稍微有了头绪，非常感谢回复 2# MMMIX


   

changsiheng

感谢，根据需求已经得到了想要的结果回复 3# tuyajie


   

changsiheng

感谢回复 4# leijskg


   

changsiheng

清晰明了回复 5# bikong0411