解析多行可变长度日志文件

Question

我希望能够利用'grep'或'pcregrep -M'解决方案来解析符合以下参数的日志文件:

• 每个日志条目的长度可以是多行
• 第一行日志条目具有我想要搜索的密钥
• 每个键出现在一行以上

因此,在下面的示例中,我希望返回包含KEY1的每一行以及它下面的所有支持行,直到下一条日志消息为止.

Log file:
01 Feb 2010 - 10:39:01.755, DEBUG - KEY1:randomtext
        blah
        blah2 T
        blah3 T
        blah4 F
        blah5 F
        blah6
        blah7
01 Feb 2010 - 10:39:01.757, DEBUG - KEY1:somethngelse
01 Feb 2010 - 10:39:01.758, DEBUG - KEY2:randomtest
this is a test
01 Feb 2010 - 10:39:01.760, DEBUG - KEY1:more logs here
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:eve more here
this is another multiline log entry
keeps on going
but not as long as before
01 Feb 2010 - 10:39:01.763, DEBUG - KEY2:testing
test test test
end of key2
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:but key 1 is still going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
okay enough
01 Feb 2010 - 10:39:01.762, DEBUG - KEY3:and so on
and on

Desired output of searching for KEY1:
01 Feb 2010 - 10:39:01.755, DEBUG - KEY1:randomtext
        blah
        blah2 T
        blah3 T
        blah4 F
        blah5 F
        blah6
        blah7
01 Feb 2010 - 10:39:01.757, DEBUG - KEY1:somethngelse

01 Feb 2010 - 10:39:01.760, DEBUG - KEY1:more logs here
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:eve more here
this is another multiline log entry
keeps on going
but not as long as before
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:but key 1 is still going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
okay enough

我试图做类似的事情:
pcregrep -M'KEY1(.*\n)+'logfile
但绝对不能正常工作.

Answer 1

如果你在*nix上,你可以使用shell

#!/bin/bash
read -p "Enter key: " key
awk -vkey="$key" '
$0~/DEBUG/ && $0 !~key{f=0}
$0~key{ f=1 }
f{print} ' file

产量

$ cat file
01 Feb 2010 - 10:39:01.755, DEBUG - KEY1:randomtext
        blah                                       
        blah2 T                                    
        blah3 T                                    
        blah4 F                                    
        blah5 F                                    
        blah6                                      
        blah7                                      
01 Feb 2010 - 10:39:01.757, DEBUG - KEY1:somethngelse
01 Feb 2010 - 10:39:01.758, DEBUG - KEY2:randomtest  
this is a test                                       
01 Feb 2010 - 10:39:01.760, DEBUG - KEY1:more logs here
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:eve more here 
this is another multiline log entry                    
keeps on going                                         
but not as long as before                              
01 Feb 2010 - 10:39:01.763, DEBUG - KEY2:testing       
test test test                                         
end of key2                                            
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:but key 1 is still going
and going                                                        
and going                                                        
and going                                                        
and going                                                        
and going                                                        
and going                                                        
and going                                                        
and going                                                        
and going                                                        
and going
and going
and going
okay enough
01 Feb 2010 - 10:39:01.762, DEBUG - KEY3:and so on
and on

$ ./shell.sh
Enter key: KEY1
01 Feb 2010 - 10:39:01.755, DEBUG - KEY1:randomtext
        blah
        blah2 T
        blah3 T
        blah4 F
        blah5 F
        blah6
        blah7
01 Feb 2010 - 10:39:01.757, DEBUG - KEY1:somethngelse
01 Feb 2010 - 10:39:01.760, DEBUG - KEY1:more logs here
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:eve more here
this is another multiline log entry
keeps on going
but not as long as before
01 Feb 2010 - 10:39:01.762, DEBUG - KEY1:but key 1 is still going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
and going
okay enough

Answer 2

添加到 Ghostdog74 的答案（非常感谢你，顺便说一句，它效果很好）

现在采用“./parse file key”形式的命令行输入并处理错误和调试的日志级别

#!/bin/bash
awk -vkey="$2" '
$0~/DEBUG|错误/ && $0 !~key{f=0}
$0~键{ f=1 }
f{打印} ' $1