将多行日志条目处理成单行

Question

我一直在使用 awk 命令向代理错误日志添加 XML 标签

awk ‘{ print “<record><data name=\”F1\” <value>=\”””\”/><data name=\”F2\” <value>=\”””\”/><data name=\”F3\” <value>=\”””\”/>; for ( i=4; i<=NF; i++ ) {printf “%s “, $i}; print (“\””); printf (“\n”) }’

每个日志条目由 "TIMESTAMP" "LOG PRIORITY" "UID" "MESSAGE" 组成并且每 5 分钟轮换一次，此代码是运行针对轮换的日志。

今天我开始收到多行日志条目，需要将其转换为格式为

的单行条目

[16/Mar/2015:10:34:12] Security(29264):
        [CLIENT4330] HTTP5094: while trying to get attribute “user”
        [CLIENT4330] HTTP5094: while trying to get attribute “invalid-password”
        [CLIENT4330] HTTP5094: ldap password check: LDAP error:
[16/Mar/2015:10:34:12] <Next Log entry>
[16/Mar/2015:10:34:12] <Next Log entry>

我一直在尝试找出如何捕获多行日志条目并将它们连接到附加到时间戳的单行条目中。缩进8个空格。

此代码是运行在 Solaris 10 实例上，我无法在其中添加除默认安装之外的任何其他软件或模块。

谢谢

Answer 1

如果行不是以 [

开头，这会将所有日志转换回单行

awk '{printf "%s",(/^\[/?RS [=10=]:[=10=])}' file

[16/Mar/2015:10:34:12] Security(29264):        [CLIENT4330] HTTP5094: while trying to get attribute .user.        [CLIENT4330] HTTP5094: while trying to get attribute .invalid-password.        [CLIENT4330] HTTP5094: ldap password check: LDAP error:
[16/Mar/2015:10:34:12] <Next Log entry>
[16/Mar/2015:10:34:12] <Next Log entry>

如果您想去掉第一个空行并在末尾换行，请使用：

awk '{printf "%s",(/^\[/ && NR>1?RS [=11=]:[=11=])} END {print ""}' t
[16/Mar/2015:10:34:12] Security(29264):        [CLIENT4330] HTTP5094: while trying to get attribute .user.        [CLIENT4330] HTTP5094: while trying to get attribute .invalid-password.        [CLIENT4330] HTTP5094: ldap password check: LDAP error:
[16/Mar/2015:10:34:12] <Next Log entry>
[16/Mar/2015:10:34:12] <Next Log entry>

额外的 space 也可以根据需要修剪掉。

将多行日志条目处理成单行

Processing multi line log entry into a single line

logging

awk