从日志中写出特定数据

Question

我在压缩文件中有大量日志，我需要按特定数据写出行，如果相同的行包含具有相同 sessionID 的 XML 消息，则将写入文件。

日志结构：

 2013-08-16 16:31:06,810 ( 122:            rogate) [98839276727]  INFO  -      UId:10453, GId:5422: new CONX started, Application Context: disconnected
 2013-08-16 16:31:34,210 ( 122:            rogate) [98839276727]  INFO  -      UId:32453, GId:1213: new CONX started, Application Context: disconnected
 2013-08-16 16:31:45,110 ( 122:            rogate) [98839276727]  INFO  -      UId:11453, GId:2133: new CONX started, Application Context: disconnected
 2013-08-16 16:31:45,729 (1093:               jms_con.cpp) [140561430333184] DEBUG  - Received XML TextMessage:
 <?xml version="1.0" encoding="UTF-8"?><>
 <version>1</version>
 <sessionId>114532133</sessionId>
 <networkProtocolId>CAPv2</networkProtocolId>
 <trafficType>Forwarding</trafficType>
  <messages>
   <reportNotificationAck/>
 <superviseReq>
 <requestSequenceNr>0</requestSequenceNr>
 <time>60000</time>
 <releaseAfterTimeExpires>false</releaseAfterTimeExpires>
  <playWarningTone>false</playWarningTone>
 </superviseReq>
 <eventReportReq>
 <requestSequenceNr>1</requestSequenceNr>
 <events>
<routeSelectFailure monitorMode="Interrupt"/>
<busy monitorMode="Interrupt"/>
<noAnswer monitorMode="Interrupt">
  <noAnswerTimer>180000</noAnswerTimer>
</noAnswer>
<answer monitorMode="Notify"/>
<disconnectCalling monitorMode="Interrupt"/>
<disconnectCalled monitorMode="Interrupt"/>
<abandon monitorMode="Notify"/>
</events>
</eventReportReq>
<continueProcessing>
<requestSequenceNr>2</requestSequenceNr>
<moreEventsExpected>true</moreEventsExpected>
<interruptEventReceived>true</interruptEventReceived>
</continueProcessing>
2013-08-16 16:59:03,666 (1252:            capgw_main.cpp) [140561430333184]  INFO  - UId:57371, GId:7137: STAT_ISIG_PROCESSING: 0.001007.
2013-08-16 16:59:03,666 ( 888:  tcap_context_storage.cpp) [140561430333184] DEBUG  - UId:57371, GId:7137: updating the Last Appl. Access Time.
2013-08-16 16:59:03,666 ( 937:  tcap_context_storage.cpp) [140561430333184] DEBUG  - UId:57371, GId:7137: new Appl. message has different direction as previously stored one, calculating the response time.
2013-08-16 16:59:03,666 (1260:            capgw_main.cpp) [140561430333184] DEBUG  - UId:57371, GId:7137: TCAP Context Storage updated successfully (received iSig message).
2013-08-16 16:59:03,666 (1263:            capgw_main.cpp) [140561430333184]  INFO  - UId:57371, GId:7137: STAT_ISIG_RESP_TIME: 0.023346
2013-08-16 16:59:03,666 ( 767:  tcap_context_storage.cpp) [140561430333184] DEBUG  - UId:57371, GId:7137: updating the Last TCAP Access Time.

第三行之后的 XML 消息与 UiD+GiD 行具有相同的 sessionID。我需要将此行写入一个新文件，如下所示：

 2013-08-16 16:31:45,110 ( 122:            rogate) [98839276727]  INFO  -      UId:11453, GId:2133: new CONX started, Application Context: disconnected
 2013-08-16 16:31:45,729 (1093:               jms_con.cpp) [140561430333184] DEBUG  - Received XML TextMessage:
 <?xml version="1.0" encoding="UTF-8"?><>
 <version>1</version>
 <sessionId>114532133</sessionId>
 <networkProtocolId>CAPv2</networkProtocolId>
 <trafficType>Forwarding</trafficType>
  <messages>
   <reportNotificationAck/>
 <superviseReq>
 <requestSequenceNr>0</requestSequenceNr>
 <time>60000</time>
 <releaseAfterTimeExpires>false</releaseAfterTimeExpires>
  <playWarningTone>false</playWarningTone>
 </superviseReq>
 <eventReportReq>
 <requestSequenceNr>1</requestSequenceNr>
 <events>
<routeSelectFailure monitorMode="Interrupt"/>
<busy monitorMode="Interrupt"/>
<noAnswer monitorMode="Interrupt">
  <noAnswerTimer>180000</noAnswerTimer>
</noAnswer>
<answer monitorMode="Notify"/>
<disconnectCalling monitorMode="Interrupt"/>
<disconnectCalled monitorMode="Interrupt"/>
<abandon monitorMode="Notify"/>
</events>
</eventReportReq>
<continueProcessing>
<requestSequenceNr>2</requestSequenceNr>
<moreEventsExpected>true</moreEventsExpected>
<interruptEventReceived>true</interruptEventReceived>
</continueProcessing>

其中一个名为 XML 消息 sessionID 的文件，如 114532133_something.txt 并将每两条日志消息写入一个新文件。

感谢您的帮助！

编辑：

尝试在没有太多成功的脚本中执行。

#!/usr/bin/awk -f

BEGIN { FS=":|," }
FNR==NR && /INFO/ {
    a[$0,$1,$2,$3,$4,$5,$6,$7,$8,$9,$10]++ ;
    next

}

END

{
    for (i in a) print i
}

Answer 1

我已将其分为多个任务。可能有人可以将这一切结合在一起。

1- 查找所有包含 INFO 的 Session ID 表单行并将其存储到文件 t1

awk -F":|," 'FNR==NR && /INFO/ {a[$6$8]++;next} END {for (i in a) print i }' xml_file >t1

2- 删除所有日志行（从 2013 年开始）并将其存储在 t2

awk  '!/^2013/' xml_file >t2

3- 如果每个 XML 批量包含在步骤 1 中找到的 ID 之一，则打印它

awk 'FNR==NR {a[$1]++;next} FNR==1 {RS="</continueProcessing>"} { for (i in a) {if ($0~i) print}}'  t1 t2

我假设所有 XML 部分都以 .如果不是这样，这将不起作用。