从nginx日志中获取2017:03:11日 11:00至12:00的日志内容
# cat
-
192.168.16.105 - - [01/Apr/2014:21:26:21 +0800] "GET / HTTP/1.1" 502 172
-
192.168.16.105 - - [01/Apr/2014:21:28:22 +0800] "GET / HTTP/1.1" 502 172
-
192.168.16.105 - - [01/Apr/2014:21:31:36 +0800] "GET / HTTP/1.1" 502 172
-
192.168.16.105 - - [01/Apr/2014:21:42:14 +0800] "GET / HTTP/1.1" 502 172
-
192.168.16.105 - - [01/Apr/2014:21:45:22 +0800] "GET / HTTP/1.1" 502 172
-
192.168.16.105 - - [01/Apr/2014:21:46:32 +0800] "GET / HTTP/1.1" 502 172
-
192.168.16.105 - - [01/Apr/2014:21:46:54 +0800] "GET / HTTP/1.1" 502 172
-
192.168.16.105 - - [01/Apr/2014:21:47:03 +0800] "GET / HTTP/1.1" 502 172
-
192.168.16.105 - - [01/Apr/2014:21:48:31 +0800] "GET / HTTP/1.1" 200 26
-
192.168.16.105 - - [01/Apr/2014:21:50:08 +0800] "GET / HTTP/1.1" 200 26
-
192.168.16.105 - - [01/Apr/2014:21:51:21 +0800] "GET / HTTP/1.1" 200 26
-
192.168.16.105 - - [01/Apr/2014:21:52:48 +0800] "GET / HTTP/1.1" 200 26
方法1：sed
-
cat .bak | egrep "11/Mar/2017" | sed -n '/11:00:00/,/12:00:00/p'
方法二：awk
-
cat | egrep "01/Apr/2014" | awk -F':' '$2 = 21 && $3 >= 30 && $3 <= 50'
注意：
1、sed中取的两个时间点21:31:36与21:50:08必须是日志中实际存在的，用21:30:01与21:50:01获取不到数据；
2、awk中$3小于等于50，包含了50:01-50:59的日志数据；
阅读(2454) | 评论(0) | 转发(0) |
