解析 log4j 和 Java 异常日志答案

【问题标题】：Parse log4j and Java exception logs解析 log4j 和 Java 异常日志
【发布时间】：2014-02-03 16:32:34
【问题描述】：

我有以下格式的错误日志：

2014-01-30 16:15:04:720 GMT [commandHandler-thread-3] ERROR com.example.Main 123-1234567-1234567 - Something bad happened.
java.lang.RuntimeException: Something bad happened.
        at ...
Caused by: java.lang.RuntimeException: ...
        at ...
        at ...
        ... 13 more
Caused by: java.lang.RuntimeException: org.hibernate.exception.ConstraintViolationException: Could not execute JDBC batch update
        at ...
        at ...
        ... 18 more
Caused by: org.hibernate.exception.ConstraintViolationException: Could not execute JDBC batch update
        at ...
        at ...
        ... 19 more
Caused by: com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException: Duplicate entry '123-1234567-1234567-2014-01-31 06:52:11' for key 'PRIMARY'
        at ...
        at ...
        ... 32 more
2014-01-31 06:58:02:933 GMT ...

我想用 grep、awk、sed 等来解析它并生成如下内容：

<filename> 123-1234567-1234567 - Something bad happened: com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException: Duplicate entry '123-1234567-1234567-2014-01-31 06:52:11' for key 'PRIMARY'

所以基本上，我想过滤该组中的所有 ERROR 行和最后一个“由”行（组由 log4j 日期分隔）。如果没有“由”行，我可以简单地拥有

<filename> 123-1234567-1234567 - Something bad happened:

编辑：我尝试过这样的事情：

grep "commandHandler.*ERROR\|^\S*Caused by"

但我不想得到不属于该特定异常的“由”行。

【问题讨论】：

首先，您可以像这样过滤掉堆栈跟踪：egrep "ERROR|Caused"

标签： linux sed awk grep log4j

【解决方案1】：

这是我到目前为止，仍然需要删除“。”在“发生”。并删除“引起：”。我必须尽快去，希望它到目前为止有帮助。不过我不是 AWK 大师！

 awk '{ 
 {for (x=1;x<=NF;x++)
    if ($x~"ERROR") {
    f++ 
    {if (c !~ f)  print "<"file">",a,b}
    a=$(x+2)" - "$(x+4)" "$(x+5)" "$(x+6)}
} 
{
   if (match($0,"Caused by:")) 
   b=$0
} 
{c=f;file=FILENAME}}
END {
print "<"file">",a,b}' javalogs* | sed 1d

【讨论】：

【解决方案2】：

已解决：

 awk '
    BEGIN { 
        OFS = "\t"; 
    } 
    function all_fields_from(start) { 
        value = ""; 
        for (i = start; i <= NF; ++i) value = value $i (i == NF ? "" : " "); 
        return value; 
    } 
    {
        if ($0 ~ /commandHandler.*ERROR/) { 
            id = $7; 
            error = all_fields_from(9);
            cause = "";
        } else if (($0 ~ /Caused by/) && (id != "")) { 
            cause = all_fields_from(3); 
        } else if ($0 ~ /^[0-9][0-9][0-9][0-9]/) { 
            if (id != "") { 
                print FILENAME, id, error, cause; 
            } 
            id = ""; 
        }
    }' 
 file

【讨论】：