nginx 日志指定字符串内部统计 求大神指点

shawnloong

12.26.72.175 10.26.109.10 - - [13/May/2017:00:00:01 +0800] "POST /test/service/code.htm HTTP/1.0" 200 148 "-" "www.test.com" "11.26.112.158:41011" "0.050" "0.049" "Java/1.8.0_101"
12.26.72.1 10.26.109.10 - - [13/May/2017:00:00:01 +0800] "POST /test/report/ReportServer?sessionID=12173&_=1502028106599 HTTP/1.0" 200 253 "-" "www.test.com" "11.26.112.158:41011" "0.050" "0.049" "Java/1.8.0_101"
13.26.72.1 10.26.109.10 - - [13/May/2017:00:00:01 +0800] "POST /test/report/ReportServer?sessionID=12175&_=1502028106599 HTTP/1.0" 200 253 "-" "www.test.com" "11.26.112.158:41011" "0.050" "0.049" "Java/1.8.0_101"
12.26.72.1 10.26.109.10 - - [13/May/2017:00:00:01 +0800] "POST /test/report/ReportServer?sessionID=12173&_=1502028106599 HTTP/1.0" 200 148 "-" "www.test.com" "11.26.112.158:41011" "0.050" "0.049" "Java/1.8.0_101"
3.3.3.3 - - [06/Aug/2017:22:03:46 +0800] "GET /mm/test.htm?ASMF1FDKSK1PcmRlckluZm8mY29kZVR5cGU9Z20= HTTP/1.1" 200 12337 "http://boss1.test.com/boss/test.htm?aWQ9NTEyN94B4Tc1Mzcm="  "-" "boss.zhiyoubao.com" "10.132.25.241:80" "0.117"   "0.017" "Mozilla/5.0 (Linux; U; Android 6.0.1; zh-cn; MI 5 Build/MXB48T) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.146 Mobile Safari/537.36 XiaoMi/MiuiBrowser/9.0.3


按照post,get 之后的路径统计流量
生成如下
/test/service 148
/test/report 654
/mm/test.htm 12337

zxy877298415

回复 1# shawnloong

1. awk -F ' "' --re-interval  '{match($2,"[^ ]+ ((/[^/.]+){2}).* ([0-9]+)$",a);b[a[1]]+=a[3]}END{for(i in b) print i,b[i]}' file
   
2. /test/service 148
   
3. /test/report 654
   
4. /mm/test 12337

复制代码

jason680

回复 1# shawnloong

$ awk 'match($0,"\"(POST|GET) ([^\"]+)\" [0-9]+ ([0-9]+)",m){k=m[2];sub("[?= ].+","",k);sub("\/[^\/]+$","",k);a[k]+=m[3]}END{for(n in a)print n,a[n]}' FILE
awk: cmd. line:1: warning: escape sequence `\/' treated as plain `/'
/test/report 654
/test/service 148
/mm 12337

shawnloong

回复 3# jason680

这个可以的．３Ｑ

moperyblue

1. awk '/"GET |"POST /{match($0,/("GET |"POST )(\/[^.?]+)\//,a);b[a[2]]++}END{for(i in b)print i,b[i]}' file

复制代码

?

shawnloong

回复 2# zxy877298415

统计有点问题，/report/后面key全有了

shawnloong

回复 6# shawnloong

统计的流量列不对．．