需要复杂的 grep awk 命令

Question

我的日志文件有很多行，下面的行是它的示例 我有 2 把钥匙。第一个键是子。 Id (1112222222) 第二个键是会话 id (xxx.apn.com;2418561818;846;60034)。

sub Id 是已知的，我需要创建一个大的 shell 命令来搜索此 sub id 的会话 id，然后在文件中搜索具有这些键之一或两者的所有行。例如下面一行包含会话 id 和子 id 对。

úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCR received. SessionId: xxx.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015

输入示例

úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCR received. SessionId: xxx.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015
úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCA received. SessionId: xxx.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015
úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCR received. SessionId: yyy.apn.com;2418561818;846;60034, SubsId: 1113333333, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015
úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCA received. SessionId: yyy.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015

输出示例

úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCR received. SessionId: xxx.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015
úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCA received. SessionId: xxx.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015
úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCA received. SessionId: yyy.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015

Answer 1

未经测试

提取给定子 ID 的会话 ID：

subsId=1112222222
sessionIds=$( grep -oP 'SessionId: [^,]+,( SubsId: $subsId,)' file.log | sort -u)

然后提取具有这些会话 ID 之一的行：

echo "$sessionIds" | grep -Ff- file.log

Answer 2

这会做你想要的，但它不会重现发布的预期输出，因为这不能反映你所说的你想要的*：

$ cat tst.awk
BEGIN { subsid = subsid"," }
NR==FNR { if ($13 == subsid) sessids[$11]; next }
($11 in sessids) || ($13 == subsid)

$ awk -v subsid=1112222222 -f tst.awk file file
úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCR received. SessionId: xxx.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015
úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCA received. SessionId: xxx.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015
úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCR received. SessionId: yyy.apn.com;2418561818;846;60034, SubsId: 1113333333, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015
úú 3 [ +548] EPC_Log: bi_tspSequenceId=1; i_tspSeverity=6;  vc_MessageInformation=CCA received. SessionId: yyy.apn.com;2418561818;846;60034, SubsId: 1112222222, IpAddr: 1.1.1.1, Protocol: Gx, RequestType: Create, APN: apn.com, Event-Trigger: ;i_Priority=6úúûû TelORB: Tue Aug 11 12:26:05 2015,  Host:úú Tue Aug 11 12:26:18 2015

* 为什么不是所有 4 行输入都出现在您在问题中显示的输出中？

您的目标 SubsId 1112222222 与第 1 行和第 2 行的 SessionId xxx.apn.com;2418561818;846;60034 以及第 4 行的 SessionId yyy.apn.com;2418561818;846;60034 相关联。

你说你想输出all lines which have one of those keys or both of them。与第 4 行一样，第 3 行具有 SessionId yyy.apn.com;2418561818;846;60034。

因此，由于匹配 SubsId 1112222222，应打印第 1、2 和 4 行，并且应为匹配 SessionId yyy.apn.com;2418561818;846;60034 打印第 3 行，因为 SubsId 1112222222 与第 4 行的该 SessionId 相关联。

对吗？