Re: Parse apache error_log

[Bart Schaefer <schaefer@brasslantern.com>]

On May 1,  3:41pm, zzapper wrote:
} Subject: Parse apache error_log
}
} Hi
} Don't know if this is a job for zsh or sed etc

I'd probably do it in perl because you need to both parse the text and
build up a data structure of results grouped by one of the fields.

} Format:-
} [Fri May 01 16:25:05 2015] [error] [client 172.18.158.61] PHP Parse error:  
} syntax error, unexpected T_VARIABLE 
} 
} I want to grab the date-time of the last entry and then display all the 
} entries with the same date-time.

The approach I would take is to create a hash keyed on the date string
with each value an array of error messages.  As each line is parsed,
push it onto the array for the date key.  You can't easily do that
in zsh (though you could just append to a text string).

However, if the file is small enough that it's OK to scan it multiple
times, you can make one pass to find the date string you care about and
then a second pass, probably with fgrep, to extract all the lines that
have that timestamp.

It sort of depends on what you want to do with the results after you have
collected them.  If you're just going to output them, perl may be more
than you need.