☰

从日志中提取信息

tag-icon • tag-icon shell-script text-processing
从日志中提取信息

无法 grep 第三个字段“电子邮件发件人”：当我使用此命令处理grep前两个字段时：

echo "TimeStamp  Email To:  Email From:" && awk '{print $1,$6}' logs

日志：

2016-05-23 11:01:40 [1005583] 1b4ivg-004DZf-GX ** [email protected] F=<abbas@DomainName> P=<abbas@DomainName> R=dkim_lookuphost T=dkim_remote_smtp H=mx2.hotmail.com [65.54.188.72]:25 I=[IP Address]:56910 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<abbas@DomainName> SIZE=275286: 550 SC-001 (BAY004-MC1F14) Unfortunately, messages from IP Address weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.
2016-05-23 11:12:53 [1015989] 1b4j6h-004GIq-Ob ** [email protected] F=<corporate-kbl@DomainName> P=<corporate-kbl@DomainName> R=lookuphost T=remote_smtp H=mx3.hotmail.com [65.55.37.120]:25 I=[IP Address]:51605 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<corporate-kbl@DomainName> SIZE=17484: 550 SC-001 (COL004-MC4F44) Unfortunately, messages from IP Address weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

想要得到：

 Timestamp:        Email To:               Email From:
 2016-05-23        [email protected]     abbas@DomainName
 2016-05-23        [email protected]       corporate-kbl@DomainName

我必须在“F=<>”而不是“$7”中 grep 第三字段电子邮件地址，如果我们在下面提到的日志中 grep 字段“$7”，它会给我收件人地址。

 2016-05-23 10:19:03 [954152] 1b4iGS-004027-BM ** [email protected] ([email protected]) <[email protected]> F=<[email protected]> P=<[email protected]> R=lookuphost T=remote_smtp H=mx2.hotmail.com [65.55.37.120]:25 I=[136.243.219.141]:35485 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=375119: 550 SC-001 (COL004-MC4F12) Unfortunately, messages from 136.243.219.141 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

`

答案1

关于什么

  awk '{ printf "%s\t%s\t%s\n",$1,$6,substr($7,4,length($7)-4) ;} ' logs

或带有标题

  awk 'BEGIN {printf "%s\t%s\t%s\n","Timestamp","email to","email from" }
             { printf "%s\t%s\t%s\n",$1,$6,substr($7,4,length($7)-4) ;} ' logs

更新新精度

awk 'NF>6 { d=6 ; while ( ! ($d ~ /^F=/ ) ) d++ ; printf "%s\t%s\t%s\n",$1,$6,substr($d,4,length($d)-4) ;} ' logs

在哪里

  • NF > 6确保至少6个字段
  • d=6 ; while ( ! ($d ~ /^F=/ ) ) d++扫描字段，F=注意如果没有这样的字段，将会发生无限循环。
  • substr($d,4,length($d)-4)和以前一样，在找到的字段上提取。

这给

2016-05-23      [email protected]     abbas@DomainName
2016-05-23      [email protected]       corporate-kbl@DomainName
2016-05-23      [email protected]    [email protected]

相关内容