Extract three substrings from a logfile

Shell Programming and Scripting
1

I have a log file like below.

66.249.73.11 - - [13/Aug/2012:06:08:45 +0000] "UCiZ7QocVqYAABgwfP8AAHAA" "US" "Mediapartners-Google" "-" www.mahashwetha.com.sg "GET /site/travel/flights/transport-results.html?skin=ensg.mahashwetha.com.sg&mondial_auto=true&DPNOC=1&DPNOA=2&DPNOI=1&DPLOC=en_SG&DPNOS=0&DPHSI=0&date_in_month=9&DPXCP=F&DPFSI=0&DPCID=0&DPXAL=F&DPTRT=flights&DPSFT=&DPXTR=F&DPTTT=R&DPBFT=False&DPXCH=F&DPXMG=F&DPHEI=2&failureURL=http%3A%2F%2Fwww.mahashwetha.com.sg%2Fsite%2Ftravel%2Fflights%2Fflights-search-error.html&DPDAP=Singapore%2C+Singapore+(SIN)&DPBFE=False&DPXIN=T&DPCLS=Y&DPPID=5003&date_out_month=9&DPFEI=9&TRANS=ViewTransportationSearchBox%2CdoSearchForTransportation%2C&IMBOSS=Z05&date_out_day=7&DPDCC=SGD&DPIDT=0001&DP1WF=0&DPFIT=flights&DPODT=0001&DPAAP=Koh+Samui%2C+Thailand+(USM)&DPAIR=NONE&date_in_day=11 HTTP/1.1" 200 12593 2670985 "81.104.178.164,66.249.73.11"

I want to extract three substrings from this and the o/p should be like this.

66.249.73.11 IMBOSS=Z05 81.104.178.164

The first one is the IP address and the second is a string as "IMBOSS=some value" (this can be anywahere in the log file, the script should just search and extract) and then finally an ip address which is normally at the second last position. I have marked the required strings in the o/p in red color.

It would be a great help if someone can help me here.

2

Hi Tuxidow

i'm not a scripting guru but maybe this is helpful for you:

#!/bin/bash

# save in the variable FILE the path to your "log" file
FILE=text

cat $FILE|while read line
do
 IP=`cat $FILE | awk '{print $1}'`
 IMBOSS=`cat $FILE|sed 's+.*IMBOSS=++g'|sed 's/&/ /g'|awk '{print $1}'`
 LASTIP=`cat $FILE |awk '{print $NF}' |sed 's/"//g'|sed 's/,/ /g'|awk '{print $1}'`
echo $IP "IMBOSS="$IMBOSS $LASTIP
done

there is certainly antother way to get the value from IMBOSS, in this case the scripts works only if the first character after IMBOSS=<some value> is a $ !!
sorry i'm not a sed expert :wink:

[root@saxmgt01 tmp]# ./script.sh
66.249.73.11 IMBOSS=Z05 81.104.178.164

try it and let me know

3

Try something this..

awk -F '[ ",&]' '{for (i=1;i<=NF;i++) {if ( $i ~ /^IMBOSS/ ) { print $1,$i,$(NF-2) }}}' file