Tuesday, April 28, 2015

Perl : Using awk type field matching in Perl

Suppose in the Apache log file we have an entry like the following

192.168.1.212 - - [24/Apr/2015:14:28:46 +0900] "POST / HTTP/1.0" 404 974 "-" "-" - 444

By default perl uses white space as field separator like awk
404 is the HTTP status code and it is the eighth field.

From the log file, to print only the lines with HTTP status as 404(which is the eight field)

cat /usr/local/apache/logs/access_log.20150424.gz | perl -lane 'print if @F[8] =~ /404/'

Few flags that make Perl more awk like, with field separators

-l makes each print statement output a record separator that is the same as input record separator (newline by default).
-Fpattern is used to specify input field separator, much like awk's -F option.

-a turns on the autosplit mode, so input fields are placed into @F array

A very common example is viewing fields in /etc/passwd

awk -F':' '{ print $1 }' /etc/passwd

perl -F':' -lane 'print @F[0]' /etc/passwd

Perl fields are @F[0], @F[1],...
awk fields are $1, $2, ...

To match the whole input line
awk - $0
Perl - $_

For more information refer
http://lifecs.likai.org/2008/10/using-perl-like-awk-and-sed.html




No comments:

Post a Comment