awk常用日志分析命令

awk '{print substr($0, 1, 16)"," substr($0, index($0, "free=")+5)}'  usdt25.txt

awk '{date=substr($0, 1, 16); if(match($0, /free=([0-9]+\.[0-9]+)/, amount)){print date ", " amount[1]}}' <logfile>

 

grep "xxxx=" gateway-0.log | awk '{match($0, /orderNo=([0-9A-Za-z]+)/, orderNo); print orderNo[1] "," substr($0, 1, 19)}'

awk split简单示例：

echo "apple,banana,orange" | awk '{split($0, fruits, ","); print fruits[1]}'

 

假设有日志文件a.txt：

{“identifier”:”E0036030520240102030003ffe823277″,”amount”:995,”orderNo”:”PR42024010123598639545392″,”orderAmount”:1000,”mchOrderNo”:”20240101235955S06P4463553860″,”fee”:5}

如何提取mchOrderNo

cat a.txt | awk -F'"mchOrderNo":"' '{split($2, orderNo, "\""); print orderNo[1]}'

cat a.txt | awk 'match($0, /"mchOrderNo":"([^"]+)"/, arr) {print arr[1]}'

 

grep a.log  | awk -F 'orderid":"' '{split($2,arr, "\""); print arr[1] "," substr($0, 1, 19)}' 

grep a.log | awk 'match($0, /orderNo=(.\w+)/, arr) {print arr[1]}'

 

源日志文件：

2024-05-11 00:53:46.032 esp={“code”:0,”msg”:”success”,”data”:{“currency”:”MXN”,”payinValue”:338.9,”payoutValue”:219648.7438,”disableValue”:0,”sign”:”db72104a7c5dda90a00f79a76e6e48532bb668aa20aa0a2a92a75bbd520e6c76″}}
2024-05-11 00:55:08.793 resp={“code”:0,”msg”:”success”,”data”:{“currency”:”MXN”,”payinValue”:0,”payoutValue”:219981.6438,”disableValue”:0,”sign”:”20f3c5ddc25f94e5408c8b453a7137094959631259c873ce2419f5493be8d169″}}

期望提取如下格式：
2024-05-11 00:53:46,219648.7438
2024-05-11 00:55:08,219981.6438

cat a.txt |awk 'match($0, /"payoutValue":([^,]+)/, arr) {print substr($0, 1, 19)","arr[1]}'

源日志：2024-05-14 00:24:00.283 resp={“data”:{“balance”:”344250.74″,”availableBalance”:”86869.74″,unsettleBal”:”28150.00″}}

cat b.txt | awk 'match($0, /"availableBalance":"([^"]+)"/, arr) {print substr($0, 1, 19)","arr[1]}'

cat c.txt| awk -F 'availableBalance":"'  '{split($2,arr,"\""); print arr[1]  "," substr($0,1,19)}'