Extract Log lines with Thread-(regex)

Shell Programming and Scripting
1

Hi everyone,

Fist of all I must confess that I am pretty new in the Unix environment and especially to shell scripting, however due to work related requirements I have started to analyze software specific logs.

The logs are structured so that it records by sessionID AND/OR Thread number, the problem is that the two do not necessarily are in all lines related to a session.

What we currently do is cat the log file and pipe it to a perl script that would print to screen all lines with the Session ID, from there we would take each line with Thread-(3 to 8 numbers) and repeat the same entry adding each unrepeated Thread-number to the entry and > to a text file.

I was wondering if you would know a way to create a qualifier i.e."-allthreads" in Perl or bash that would directly capture each occurence of Thread-/\d{3-8}/ and add it to the search.

Ideas? I dont know if I was clear,
Thanks in advance.

Sushimatt.

2

A much better way to describe this is to provide a short, real-life demonstration using dummy data. Cook up some data in a text file and show us the input to and output from the Perl script. And the changes you want further.

As for the question about passing a qualifier - you could pass a single-character switch to the perl interpreter and then use the "getopts" method of the "GetOpt::Std" module to
(a) parse the switch and (b) perform relevant actions based on the switch.

Link to the CPAN page:

getopts - search.cpan.org

tyler_durden

3

Well, The thing is exactly that, I dont get it to return any data. The files have a structure where each line have a thread number and data after it:

2011-09-01 00:05:00,286 9220793 [Thread-17608] DATA DATA DATA.

I simply want the script to return in a line each instance of thread numbers through piping a cat command.

#!/usr/bin/perl
#2011-09-01 00:05:00,286 9220793 [Thread-17608]
my ($thread) = $_ =~ /\[Thread-\s*(.+?)\]/;
%seen = ();
@threads = ();

while (<STDIN>) {
        if ($_ =~ m/\[Thread-\s*(.+?)\]/) { unless ($seen{$thread}) {
        push (@threads, $thread);
        $seen{$thread}++;
        }}  else {
        $seen{$thread}++;
        }
}
        foreach (@threads) {
        print "$_";
        }

Any ideas?

4

Could this help you ?
use this

if ($_ =~ m/\[Thread-\s*$thread\]/)

instead of

if ($_ =~ m/\[Thread-\s*(.+?)\]/)