是否可能从具有两种不同日期格式的日志文件中提取数据?

Question

我有两个日志文件

Log1:
Apr 10 02:07:20  Data 1
Apr 11 02:07:20  Data 1
May 10 04:11:09  Data 2
May 12 04:11:09  Data 2
Log 2
[10/04/16 02:07:20  BST] Data 1
[11/04/16 02:07:20  BST] Data 1
[10/05/16 04:11:09  BST] Data 2
[12/05/16 04:11:09  BST] Data 2

我想提取在起始时间和结束时间之间指定的数据。我正在使用以下代码。但是这行不通。

log1="$(awk '/LOG_FILE1/{print $NF}' log.conf)"
log2="$(awk '/LOG_FILE2/{print $NF}' log.conf)"
StartTime="$1 $2 $3"
EndTime="$4 $5 $6"
echo $StartTime
echo $EndTime
if [ $log1=log_1.log ]
then
{
for file in $log1;
do     
echo "$file:";    
sort -t' ' -k1,1M -k2,3n $file | sed -n "/$StartTime/,/$EndTime/p";
done
}
fi
if [ $log2=log_2.log ]
then
{
for file in $log2;
do     
echo "$file:";    
sort -n -k 1.5 -k 1.3 -k 1 $file | sed -n "/$StartTime/,/$EndTime/p";
done
}
fi

任何输入都可以是

.filename Apr 10 02:07:20 May 12 04:11:09

或

.filename [10/04/16 02:07:20  BST] [12/05/16 04:11:09  BST]

其中filename是包含上述代码的文件。我没有得到的结果，因为在日志文件中的数据是在不同的格式?如何修改代码以提取数据?

对于两个给定的输入，我期望我的输出如下，

 Log1:
Apr 10 02:07:20  Data 1
Apr 11 02:07:20  Data 1
May 10 04:11:09  Data 2
May 12 04:11:09  Data 2
Log 2
[10/04/16 02:07:20  BST] Data 1
[11/04/16 02:07:20  BST] Data 1
[10/05/16 04:11:09  BST] Data 2
[12/05/16 04:11:09  BST] Data 2

对于第一个输入，我得到的输出是，

May 10 04:11:09
May 12 04:11:09
log_1.Log:
May 10 04:11:09  Data 2
May 12 04:11:09  Data 
log_2.log:

第二个输入的输出是

[10/04/16 02:07:20 BST]
[12/05/16 04:11:09 BST]
log_1.Log:
Apr 10 02:07:20  Data 1
Apr 11 02:07:20  Data 1
May 10 04:11:09  Data 2
May 12 04:11:09  Data 2
log_2.log:
[10/04/16 02:07:20  BST] Data 1
[11/04/16 02:07:20  BST] Data 1
[10/05/16 04:11:09  BST] Data 2
[12/05/16 04:11:09  BST] Data 2

如何修改以获得确切的结果?

Answer 1

您还没有向我们展示您期望的输出，所以idk是否输出您想要的结果，但这是我认为您想要的方法，使用GNU awk进行时间函数:

$ cat tst.awk
function mthDayTime2secs(mthDayTime,    t, mthNr) {
     split(mthDayTime, t, / /)
     mthNr = (match("JanFebMarAprMayJunJulAugSepOctNovDec",t[1])+2)/3
     return mktime(thisYear" "mthNr" "t[2]" "gensub(/:/," ","g",t[3]))
}
function mthDayYearTime2secs(mthDayYearTime,    t) {
     split(mthDayYearTime, t, /[/ ]/)
     return mktime(thisCent t[3]" "t[1]" "t[2]" "gensub(/:/," ","g",t[4]))
}
function spec2secs(spec,        secs) {
    if (spec ~ /^[/) {
        secs = mthDayYearTime2secs(gensub(/.(.{17}).*/,"\1",1,spec))
    }
    else {
        secs = mthDayTime2secs(gensub(/(.{15}).*/,"\1",1,spec))
    }
    return secs
}
BEGIN {
    thisYear = strftime("%Y")
    thisCent = gensub(/..$/,"",1,thisYear)
    begSecs = spec2secs(begSpec)
    endSecs = spec2secs(endSpec)
}
{ currSecs = spec2secs($0) }
currSecs >= begSecs && currSecs <= endSecs

.

$ awk -v begSpec="Apr 10 02:07:20" -v endSpec="May 10 04:11:09" -f tst.awk log1 log2
Apr 10 02:07:20  Data 1
Apr 11 02:07:20  Data 1
May 10 04:11:09  Data 2
$ awk -v begSpec="May 03 02:07:20" -v endSpec="Oct 05 04:11:09" -f tst.awk log1 log2
May 10 04:11:09  Data 2
[10/04/16 02:07:20  BST] Data 1
[10/04/16 09:07:20  BST] Data 1