☰

sed를 사용하여 중간 선 제거

tag-icon • tag-icon sed
sed를 사용하여 중간 선 제거

다음과 같은 로그 형식이 있습니다.

2017-12-22T23:32:07-05:00 ServerABC sshd[22549]: Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:07-05:00 ServerABC sshd[60944]: Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:07-05:00 ServerABC sshd[1787]: [ID 800047 dns.info] Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:13-05:00 ServerABC sshd[1367]: [ID 800047 dns.info] Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:14-05:00 ServerABC sshd[36061]: Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:17+00:00 ServerABC sshd[31616]: Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2

나는 그것을 구문 분석하기 위해 다음 명령을 사용했습니다. 그런데 "[ID:800047 dns.info]"를 제거할 수 없는 것 같습니다.

sed를 사용하여 중간 선을 제거하는 더 쉬운 방법이 있습니까?

grep -E '(Accepted|for JohnBlezard)' testing.txt | grep "JohnBlezard from" | awk '{print $2, $5, $7, $9, $11}'

예상 결과는 다음과 같아야합니다

[ServerABC] [password] [JohnBlezard] [IP Address]

그러나 구문 분석 후 일부 줄에서는 다음과 같은 결과가 발생한다는 것을 알았습니다.

[ServerABC] [ID 800047] [Accepted] [for] [from]

답변1

싱글로awk주문하다:

awk '/Accepted .+ for JohnBlezard/{ 
         if ($4 == "[ID") { $5 = $8; $7 = $10; $9 = $12; $11 = $14 }
         print $2, $5, $7, $9, $11
     }' test.txt

산출:

ServerABC password JohnBlezard 192.168.1.1 81111
ServerABC password JohnBlezard 192.168.1.1 81111
ServerABC password JohnBlezard 192.168.1.1 81111
ServerABC password JohnBlezard 192.168.1.1 81111
ServerABC password JohnBlezard 192.168.1.1 81111
ServerABC password JohnBlezard 192.168.1.1 81111

답변2

다음 명령을 사용하여 이 줄을 제거할 수 있습니다.grep -v

~에서man grep

       -v, --invert-match
          Invert the sense of matching, to select non-matching lines.  (-v is specified by POSIX.)

그래서

$ cat test
2017-12-22T23:32:07-05:00 ServerABC sshd[22549]: Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:07-05:00 ServerABC sshd[60944]: Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:07-05:00 ServerABC sshd[1787]: [ID 800047 dns.info] Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:13-05:00 ServerABC sshd[1367]: [ID 800047 dns.info] Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:14-05:00 ServerABC sshd[36061]: Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2
2017-12-22T23:32:17+00:00 ServerABC sshd[31616]: Accepted password for JohnBlezard from 192.168.1.1 port 81111 ssh2

예상되는 결과

$ grep -E '(Accepted|for JohnBlezard)' test | grep -v "\[ID" | grep "JohnBlezard from" | awk '{print $2, $5, $7, $9, $11}'
ServerABC password JohnBlezard 192.168.1.1 81111
ServerABC password JohnBlezard 192.168.1.1 81111
ServerABC password JohnBlezard 192.168.1.1 81111
ServerABC password JohnBlezard 192.168.1.1 81111

답변3

이 sed를 사용해 볼 수 있습니다

sed -E '
 h
  s/(.*: (\[[^\]*\] )*)//
  s/(( *[^ ]*){6})(.*)/\1/
  s/( *[^ ]* )([^ ]*)/[\2] /g
 x
  s/([^ ]* )([^ ]*).*/ [\2]/
 G
  y/\n/ /
' infile

관련 정보