变量在 awk 中总是等于 true

Question

我想使用 awk 过滤一些日志文件以查找具有特定请求 ID 的行。这是我的日志文件的一部分：

2014-01-16 00:00:36,862 DEBUG [CalculationLog] REQUEST:9822897effffffc06a4be2a523754852 zkTestScheduledFormula contract invoked
2014-01-16 00:01:36,822 DEBUG [CalculationLog] REQUEST:982373b5ffffffc06a4be2a5480cb66a zkTestScheduledFormula contract invoked
2014-01-16 00:02:36,940 DEBUG [CalculationLog] REQUEST:98245e8cffffffc06a4be2a555021fe6 zkTestScheduledFormula contract invoked
2014-01-16 00:03:37,199 DEBUG [CalculationLog] REQUEST:982549eeffffffc06a4be2a557aa8d3a zkTestScheduledFormula contract invoked
2014-01-16 00:04:37,446 DEBUG [CalculationLog] REQUEST:98263546ffffffc06a4be2a58411decd zkTestScheduledFormula contract invoked
2014-01-16 00:05:37,742 DEBUG [CalculationLog] REQUEST:982720cdffffffc06a4be2a5c7f7d2a1 zkTestScheduledFormula contract invoked
2014-01-16 00:06:37,890 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
here
is
some
text
2014-01-16 00:07:38,096 DEBUG [CalculationLog] REQUEST:9828f6efffffffc06a4be2a5bb4f7883 zkTestScheduledFormula contract invoked
2014-01-16 00:08:38,386 DEBUG [CalculationLog] REQUEST:9829e272ffffffc06a4be2a5fa9054ea zkTestScheduledFormula contract invoked
2014-01-16 00:11:38,677 DEBUG [CalculationLog] REQUEST:982ca2b4ffffffc06a4be2a57d1274ed zkTestScheduledFormula contract invoked
2014-01-16 00:12:39,016 DEBUG [CalculationLog] REQUEST:982d8e68ffffffc06a4be2a5ef067a13 zkTestScheduledFormula contract invoked
2014-01-16 00:13:39,567 DEBUG [CalculationLog] REQUEST:982e7aefffffffc06a4be2a5e34e2938 zkTestScheduledFormula contract invoked
2014-01-16 00:14:39,910 DEBUG [CalculationLog] REQUEST:982f66a4ffffffc06a4be2a5a6efe09f zkTestScheduledFormula contract invoked
2014-01-16 00:25:42,276 DEBUG [CalculationLog] REQUEST:98398204ffffffc06a4be2a509da6070 zkTestScheduledFormula contract invoked
2014-01-16 00:26:42,451 DEBUG [CalculationLog] REQUEST:983a6d12ffffffc06a4be2a52686b6da zkTestScheduledFormula contract invoked
2014-01-16 00:27:42,554 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
2014-01-16 00:28:42,769 DEBUG [CalculationLog] REQUEST:983c430fffffffc06a4be2a54d9c2af4 zkTestScheduledFormula contract invoked
2014-01-16 00:34:44,150 DEBUG [CalculationLog] REQUEST:9841c6b5ffffffc06a4be2a55719bea1 zkTestScheduledFormula contract invoked
2014-01-16 00:35:44,342 DEBUG [CalculationLog] REQUEST:9842b1d6ffffffc06a4be2a517e47e3f zkTestScheduledFormula contract invoked
2014-01-16 00:36:44,527 DEBUG [CalculationLog] REQUEST:98439cefffffffc06a4be2a5de1291de zkTestScheduledFormula contract invoked
2014-01-16 00:37:44,790 DEBUG [CalculationLog] REQUEST:98448856ffffffc06a4be2a555d6c6d7 zkTestScheduledFormula contract invoked
2014-01-16 00:38:44,975 DEBUG [CalculationLog] REQUEST:9845736dffffffc06a4be2a5f1b61900 zkTestScheduledFormula contract invoked
2014-01-16 00:47:46,866 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
here also
is something
it may
be some
exception
and I want
to print it
2014-01-16 00:51:48,271 DEBUG [CalculationLog] REQUEST:9851672fffffffc06a4be2a55cbc8aae zkTestScheduledFormula contract invoked
2014-01-16 00:55:49,325 DEBUG [CalculationLog] REQUEST:985514ccffffffc06a4be2a5ec3ad03c zkTestScheduledFormula contract invoked
2014-01-16 01:01:51,193 DEBUG [CalculationLog] REQUEST:985a9a59ffffffc06a4be2a5c7f22685 zkTestScheduledFormula contract invoked
2014-01-16 01:03:51,553 DEBUG [CalculationLog] REQUEST:985c7081ffffffc06a4be2a5f888aa10 zkTestScheduledFormula contract invoked
2014-01-16 01:04:51,816 DEBUG [CalculationLog] REQUEST:985d5be8ffffffc06a4be2a5ad80c024 zkTestScheduledFormula contract invoked
2014-01-16 01:13:53,211 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
2014-01-16 01:14:53,342 DEBUG [CalculationLog] REQUEST:9866899dffffffc06a4be2a5207c84d0 zkTestScheduledFormula contract invoked
2014-01-16 01:15:53,455 DEBUG [CalculationLog] REQUEST:9867746fffffffc06a4be2a53ae4e293 zkTestScheduledFormula contract invoked
2014-01-16 01:16:53,617 DEBUG [CalculationLog] REQUEST:98685f71ffffffc06a4be2a525a15b99 zkTestScheduledFormula contract invoked
2014-01-16 01:17:53,723 DEBUG [CalculationLog] REQUEST:98694a3bffffffc06a4be2a5526c88e3 zkTestScheduledFormula contract invoked

为了过滤这个日志文件，我编写了以下 awk 脚本：

{for(i=1;i<=NF;i++){ if(match($i, /REQUEST:[0-9a-z]*/)){currentRequest = substr($i, 9); break; } } }
currentRequest == "98280bc2ffffffc06a4be2a5d6b0c173" {printLine = true; foundFirst = true; print "+++"}
currentRequest != "98280bc2ffffffc06a4be2a5d6b0c173" {printLine = false; print "---"}
{if (printLine == true && foundFirst == true) print $0}

我不知道为什么我的 printLine 变量总是等于 true 并且所有的行都被打印出来了。我可以在要打印和删除的行之前看到“+++”和“---”。但所有这些都是打印出来的。有人知道出了什么问题吗？

Answer 1

基本问题

true 和 false 都只是 awk 变量，通过您引用它们而存在，因此它们的值都是 0。

请改用0 和1：

{for(i=1;i<=NF;i++){ if(match($i, /REQUEST:[0-9a-z]*/)){currentRequest = substr($i, 9); break; } } }
currentRequest == "98280bc2ffffffc06a4be2a5d6b0c173" {printLine = 1; foundFirst = 1; print "+++"}
currentRequest != "98280bc2ffffffc06a4be2a5d6b0c173" {printLine = 0; print "---"}
{if (printLine == 1 && foundFirst == 1) print $0}

脚本还有很大的改进空间，但这是您遇到的关键点。

更广泛地重写

我在字里行间阅读，但我认为这个脚本可能会满足您的需求。看起来好像您希望具有指定请求号的行块以+++ 开头并以--- 结尾；而且您可能不希望打印任何其他行。所以输出将是+++，后跟一或多行请求，然后是---，必要时重复。

BEGIN { req = "REQUEST:98280bc2ffffffc06a4be2a5d6b0c173" }
      { if ($5 == req)
        {
            if (!printing) print "+++"
            printing = 1
        }
        else
        {
            if (printing) print "---"
            printing = 0
        }
        if (printing) print $0
      }
END   { if (printing) print "---" }

给定您显示的数据的轻微修改版本，它会产生输出：

+++
2014-01-16 00:06:37,890 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---
+++
2014-01-16 00:27:42,554 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---
+++
2014-01-16 00:47:46,866 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---
+++
2014-01-16 01:13:53,211 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
2014-01-16 01:13:53,222 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
2014-01-16 01:13:53,233 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---
+++
2014-01-16 01:18:00,999 DEBUG [CalculationLog] REQUEST:98280bc2ffffffc06a4be2a5d6b0c173 zkTestScheduledFormula contract invoked
---

“轻微修改”是 (1) 为数据中带有小数秒 222 和 233 的请求添加两行额外的行（因此同一请求有 3 个连续行的块），以及 (2) 添加一个请求在文件末尾（测试END 块）。