Parse apache error_log

Parse apache error_log

[zzapper]

Hi
Don't know if this is a job for zsh or sed etc

Format:-
[Fri May 01 16:25:05 2015] [error] [client 172.18.158.61] PHP Parse error:  
syntax error, unexpected T_VARIABLE 

I want to grab the date-time of the last entry and then display all the 
entries with the same date-time.

This means I get all the entries associated with one bug

ideas?

-- 
zzapper
https://twitter.com/dailyzshtip

---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com

Re: Parse apache error_log

[Bart Schaefer]

On May 1,  3:41pm, zzapper wrote:
} Subject: Parse apache error_log
}
} Hi
} Don't know if this is a job for zsh or sed etc

I'd probably do it in perl because you need to both parse the text and
build up a data structure of results grouped by one of the fields.

} Format:-
} [Fri May 01 16:25:05 2015] [error] [client 172.18.158.61] PHP Parse error:  
} syntax error, unexpected T_VARIABLE 
} 
} I want to grab the date-time of the last entry and then display all the 
} entries with the same date-time.

The approach I would take is to create a hash keyed on the date string
with each value an array of error messages.  As each line is parsed,
push it onto the array for the date key.  You can't easily do that
in zsh (though you could just append to a text string).

However, if the file is small enough that it's OK to scan it multiple
times, you can make one pass to find the date string you care about and
then a second pass, probably with fgrep, to extract all the lines that
have that timestamp.

It sort of depends on what you want to do with the results after you have
collected them.  If you're just going to output them, perl may be more
than you need.

Re: Parse apache error_log

[Peter Stephenson]

On Fri, 1 May 2015 15:41:37 +0000 (UTC)
zzapper <david@rayninfo.co.uk> wrote:
> Don't know if this is a job for zsh or sed etc
> 
> Format:-
> [Fri May 01 16:25:05 2015] [error] [client 172.18.158.61] PHP Parse error:  
> syntax error, unexpected T_VARIABLE 
> 
> I want to grab the date-time of the last entry and then display all the 
> entries with the same date-time.

Well, you *could* do this...

log=wherever
fgrep -h "$(tail -1 $log | sed 's/^\[\([^]]*\)\].*/\1/')" $log

pws

Re: Parse apache error_log

[zzapper]

Peter Stephenson <p.w.stephenson@ntlworld.com> wrote in
news:20150501220311.6f101a62@ntlworld.com: 

> On Fri, 1 May 2015 15:41:37 +0000 (UTC)

> 
> Well, you *could* do this...
> 
> log=wherever
> fgrep -h "$(tail -1 $log | sed 's/^\[\([^]]*\)\].*/\1/')" $log
> 
> pws
> 
Yep Does the job. 


-- 
zzapper
https://twitter.com/dailyzshtip

---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com