实际日志是：
2016-06-19 22:08:09 [213917] 1bEgCe-000tZR-E9 ** [email protected] ([email protected]) <[email protected]> F=<[email protected]> P=<[email protected]> R=lookuphost T=remote_smtp H=mailin-01.mx.aol.com [64.12.88.131]:25 I=[36.23.21.11]:60147: SMTP error from remote mail server after initial connection: 554- (RTR:BL) https://postmaster.aol.com/error-codes#554rtrbl\n554 Connecting IP: 36.23.21.11
2016-06-20 01:03:22 [516458] 1bEiwD-001zt7-IY ** [email protected] ([email protected]) <[email protected]> F=<[email protected]> P=<[email protected]> R=lookuphost T=remote_smtp H=mailin-02.mx.aol.com [64.12.88.163]:25 I=[36.23.21.14]:47630: SMTP error from remote mail server after initial connection: 554- (RTR:BL) https://postmaster.aol.com/error-codes#554rtrbl\n554 Connecting IP: 36.23.21.14
2016-06-20 09:29:46 [256975] 1bEqpT-0014jI-HV ** [email protected] F=<[email protected]> P=<[email protected]> R=dkim_lookuphost T=dkim_remote_smtp H=mailin-04.mx.aol.com [64.12.88.132]:25 I=[36.23.21.11]:43705: SMTP error from remote mail server after initial connection: 421 DYN:T2 https://postmaster.aol.com/error-codes#554rtrbl\n554 Connecting IP: 36.23.21.11
2016-06-20 11:41:34 [413114] 1bEstm-001jSC-Ic ** [email protected] F=<[email protected]> P=<[email protected]> R=dkim_lookuphost T=dkim_remote_smtp H=mailin-02.mx.aol.com [64.12.91.195]:25 I=[36.23.21.14]:48714: SMTP error from remote mail server after initial connection: 421 DYN:T1 https://postmaster.aol.com/error-codes#554rtrbl\n554 Connecting IP: 36.23.21.14
我想得到什么：
Timestamp EmailTo: EmailFrom: IPAddress: ErrorCodes:
2016-06-19 [email protected] [email protected] 36.23.21.11 554- (RTR:BL)
2016-06-20 [email protected] [email protected] 36.23.21.14 554- (RTR:BL)
2016-06-20 [email protected] [email protected] 36.23.21.11 421 DYN:T2
2016-06-20 [email protected] [email protected] 36.23.21.14 421 DYN:T1
我从以下命令中提取了前三个字段：
echo -e "Timestamp\t\tEmailTo:\t\tEmailFrom:\t\t\t\t\t\t\t\tIPAddress:\tErrorCodes:" && awk 'NF>6 { d=6 ; while ( ! ($d ~ /^F=/ ) ) d++ ; printf "%s\t%s\t%s\n",$1,$6,substr($d,4,length($d)-4) ;} ' logs | column -t
感谢所有人，但我已经做到了：
echo -e "Timestamp:\tEmailTo:\tEmailFrom:\t\tIPAddress:\tErrorCodes:" && awk 'NF>6 { d=6 ; while ( ! ($d ~ /^F=/ ) ) d++ ; print "%s\t%s\t%s\t%s\t%s\t%s\n",$1,$6,substr($d,4,length($d)-4),$NF,$(NF-5)$(NF-4) ; }' oops | column -t| grep -v "%s"
答案1
您使用 awk 的方向是正确的。您应该编写一个脚本来读取日志，并使用制表符分隔的字段进行输出。然后使用 column 命令重新对齐列：
提取.awk²：
BEGIN {OFS="\t"; print "Timestamp\tEmailTo:\tEmailFrom:\tIPAddress:\tErrorCodes:"}
{print $1, $6, $7, $NF, $(NF-5)}
然后使用以下命令运行它：
awk -f extract.awk logs | column -t -s '^I'
其中'^I'代表引号中的实际选项卡。
唯一棘手的部分是处理日志中的错误消息，该消息可能是可变数量的单词。我通过计算 IP 和错误代码字段右侧的列来解决这个问题。
输出如下：
Timestamp EmailTo: EmailFrom: IPAddress: ErrorCodes:
2016-06-19 [email protected] ([email protected]) 36.23.21.11 554-
2016-06-20 [email protected] ([email protected]) 36.23.21.14 554-
2016-06-20 [email protected] F=<[email protected]> 36.23.21.11 421
2016-06-20 [email protected] F=<[email protected]> 36.23.21.14 421
我可能对输入列的猜测是错误的，因为您没有指定哪个是哪个，如果您想清理第三列中的电子邮件地址，那么您可能对 awk 来说太深了，是时候考虑使用Python 或 Perl。
或使用您选择的输出分隔符，只要它不在任何数据中即可。然后将其用作-s的参数column。
²正如 @Kusalananda 指出的那样，没有理由将 awk 脚本编写为一行代码。这是他的版本：
BEGIN {
OFS="\t";
print "Timestamp\tEmailTo:\tEmailFrom:\tIPAddress:\tErrorCodes:";
}
{
print $1, $6, $7, $NF, $(NF-5);
}
就我而言，我喜欢一句台词。