nginx_access日志处理

jgrlj322

如题,求一个shell.日志格式如下
100.116.128.29 - - [31/Aug/2017:03:32:57 +0800] "GET /ccc/index/js/main/index-29560643.js HTTP/1.0" 200 15864 "https://www.test.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36" "42.156.136.10" www.test.com - - - 0.000

100.116.128.83 - - [31/Aug/2017:08:15:43 +0800] "OST /login/ajax HTTP/1.0" 200 114 "https://www.test.com/" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.75 Safari/537.36 LBBROWSER" "113.235.12.33" www.test.com 127.0.0.1:8000 200 0.024 0.024


要求
输出第一个列:100.116.128.83
输出第二列:31/Aug/2017:08:15:43 +0800
输出第三列请求类型OST/GET
输出第四列状态码:200
输出第五列网站地址:https://www.test.com/
输出第七列浏览器类型:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36
输出第八列访问实际IP:113.235.12.33
并
统计实际IP访问次数.
求大神给写一个最好能像表格一样显示出来的.

william_djj

回复 1# jgrlj322
试试?
BEGIN{  OFS="||";
}
{
match($0, "http[^\"]+\" \"([^\"]+)\" \"([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\"", m); #browser and url
s[m[2]]++;
#match($0, "http[^\"]+\" \"([^\"]+)\"", m); #browser
sub("\\[|\\]", "", $4);#time
sub("\\[|\\]", "", $5);#time
gsub("\"", "", $6);  #GET
gsub("\"", "", $11); #url
print $1, $4" "$5, $6, $9, $11, m[1], m[2];
}
END{
print "\nsum up ip access:";
for(i in s) print i, s; #统计每个实际ip访问总数
}