Merging multiple log files by date including multilines

后端 未结 5 1402
误落风尘
误落风尘 2021-02-07 13:15

I have several logs containing lines all starting with a timestamp, so that the following works as expected to merge them:

cat myLog1.txt myLog2.txt | sort -n &g         


        
5条回答
  •  鱼传尺愫
    2021-02-07 14:15

    Nope - can't be done with a simple command IMMHO.

    But - here's a script to do it (it was a challenge...)

    @ECHO OFF
    SETLOCAL
    :: First log to tempfile
    COPY /y mylog.txt "%temp%\combinedlogs.tmp" >NUL
    (
    FOR /f "delims=" %%i IN (mylog2.txt) DO (
     SET line=%%i
     ECHO %%i|FINDSTR /b /r "[012][0-9]:[0-5][0-9]:[0-5][0-9]\.[0-9][0-9][0-9]" >NUL
     IF ERRORLEVEL 1 (
      SETLOCAL ENABLEDELAYEDEXPANSION
     ECHO(!stamp:~0,12!!count!!line!
      ENDLOCAL
      SET /a count+=1
     ) ELSE (
     SET /a count=100
     ECHO %%i
     SET stamp=%%i
     )
    )
    )>>"%temp%\combinedlogs.tmp"
    (
    FOR /f "delims=" %%i IN ('SORT "%temp%\combinedlogs.tmp"') DO (
     SET line=%%i
     SETLOCAL enabledelayedexpansion
     IF "!line:~12,1!"==" " (ECHO(%%i) ELSE (ECHO(!line:~15!)
     ENDLOCAL
    )
    )>combinedlogs.txt
    DEL "%temp%\combinedlogs.tmp" /F /Q
    

    Copy the first log with all-timestamped entries to a tempfile
    Process the second file by

    • outputting any timestamped line directly, saving the stamp line and setting a 3-digit counter
    • Outputting the stamp portion+counter+originaltext for other lines and bumping the counter

    Tempfile thus is

    Timestamp1 line1 from file1
    ..
    Timestampn linen from file1
    timestampA line1 from file2 with timestamp
    timestampA100 UNtimestamped line2from file2
    timestampA101 UNtimestamped line3from file2
    timestampB line4 from file2 with timestamp
    timestampB100 UNtimestamped line5from file2
    timestampB101 UNtimestamped line6from file2
    ...
    

    Sorting the result and reprocessing
    A line with a non-space in the 13th character is an untimestamped line from the second file, so

    • output all but the the first 15 chars (timestamp 12 chars + 3 for counter)
    • otherwise, timestamped line, so output all.

    Done!

提交回复
热议问题