查找包含字符串的行并使用shell脚本将值回显到新行

一行：

awk '/coderbyte heroku/router/ { split($10,map,"=");id=map[2];split($11,map1,""");print map1[2]=="MASKED"?id" [M]":id }' web-logs-raw

说明：

awk '/coderbyte heroku/router/ { # Search for lines with required text
split($10,map,"="); # Split the 10th space delimited field into the array map using "=" as the field separator
id=map[2]; # Set the variable id to the the second index of the map array
split($11,map1,"""); # Split the 11th field into the array map1 using " as the field separator (this is the masked variable)
print map1[2]=="MASKED"?id" [M]":id # If the masked entry is MASKED, print "[M]" and then the id otherwise just print the id
}' web-logs-raw  

输出：

b19a87a1-1bbb-4e67-b207-bd9f23d46afa
910b07d1-3f71-4347-a1a7-bfa20384ef65
097bf65e-e189-4f9f-9dfb-4758cff411b2
d48278c2-5731-464e-be38-ab9ad84ac4a8
8bb2413c-3c67-4180-8091-000313b8d9ca [M]
10f93da3-2753-48a3-9485-857a93d8a88a [M]

另一个选项是使用模式并匹配coderbyte heroku/router，并在捕获组中捕获request_id和fwd="MASKED"。

测试组2是否为空。如果不是，则写request_id，后跟[M]，否则只写请求id。

使用gnu-awk和第三个参数来捕获组(如@anubhava所述(

awk '
match($0, /^.*?<coderbyte heroku/router>.* request_id=(S+) (fwd="MASKED)?/, m) {
print m[2]? m[1] " [M]": m[1]
}
' web-logs-raw

输出

b19a87a1-1bbb-4e67-b207-bd9f23d46afa
910b07d1-3f71-4347-a1a7-bfa20384ef65
097bf65e-e189-4f9f-9dfb-4758cff411b2
d48278c2-5731-464e-be38-ab9ad84ac4a8
8bb2413c-3c67-4180-8091-000313b8d9ca [M]
10f93da3-2753-48a3-9485-857a93d8a88a [M]

另一个可能很容易阅读的选项

cat web-logs-raw | grep "coderbyte heroku/router" | cut -d' ' -f10,11 | awk -F'=' '{print $2,$3} ' |
awk -F" '{print $1,$2}' | cut -d' ' -f1,4 | awk '{ if ( $2 == "MASKED") print $1" [M]"; else print $1 }'

说明：

cat web-logs-raw  | grep "coderbyte heroku/router" | cut -d' ' -f10,11
till this we find this word coderbyte heroku/router and print only request id and fwd fields
Output: 
request_id=b19a87a1-1bbb-4e67-b207-bd9f23d46afa fwd="108.31.000.000"
request_id=910b07d1-3f71-4347-a1a7-bfa20384ef65 fwd="108.31.000.000"
request_id=097bf65e-e189-4f9f-9dfb-4758cff411b2 fwd="108.31.000.000"
request_id=d48278c2-5731-464e-be38-ab9ad84ac4a8 fwd="108.31.000.000"
request_id=8bb2413c-3c67-4180-8091-000313b8d9ca fwd="MASKED"
request_id=10f93da3-2753-48a3-9485-857a93d8a88a fwd="MASKED"
then after this we need to remove requst_id field and fwd`s double questes
cat web-logs-raw | grep "coderbyte heroku/router" | cut -d' ' -f10,11 | awk -F'=' '{print $2,$3} ' |
awk -F" '{print $1,$2}'
output:
b19a87a1-1bbb-4e67-b207-bd9f23d46afa fwd  108.31.000.000
910b07d1-3f71-4347-a1a7-bfa20384ef65 fwd  108.31.000.000
097bf65e-e189-4f9f-9dfb-4758cff411b2 fwd  108.31.000.000
d48278c2-5731-464e-be38-ab9ad84ac4a8 fwd  108.31.000.000
8bb2413c-3c67-4180-8091-000313b8d9ca fwd  MASKED
10f93da3-2753-48a3-9485-857a93d8a88a fwd  MASKED
just after this now we only need to remove the fwd 
cat web-logs-raw | grep "coderbyte heroku/router" | cut -d' ' -f10,11 | awk -F'=' '{print $2,$3} ' |
awk -F" '{print $1,$2}' | cut -d' ' -f1,4 
output: 
b19a87a1-1bbb-4e67-b207-bd9f23d46afa 108.31.000.000
910b07d1-3f71-4347-a1a7-bfa20384ef65 108.31.000.000
097bf65e-e189-4f9f-9dfb-4758cff411b2 108.31.000.000
d48278c2-5731-464e-be38-ab9ad84ac4a8 108.31.000.000
8bb2413c-3c67-4180-8091-000313b8d9ca MASKED
10f93da3-2753-48a3-9485-857a93d8a88a MASKED
then we need to remove this fwd_key field 
cat web-logs-raw | grep "coderbyte heroku/router" | cut -d' ' -f10,11 | awk -F'=' '{print $2,$3} ' |
awk -F" '{print $1,$2}' | cut -d' ' -f1,4 | awk '{ if ( $2 == "MASKED") print $1" [M]"; else print $1 }'
output:
19a87a1-1bbb-4e67-b207-bd9f23d46afa
910b07d1-3f71-4347-a1a7-bfa20384ef65
097bf65e-e189-4f9f-9dfb-4758cff411b2
d48278c2-5731-464e-be38-ab9ad84ac4a8
8bb2413c-3c67-4180-8091-000313b8d9ca [M]
10f93da3-2753-48a3-9485-857a93d8a88a [M]

尝试Perl

$ perl -ne ' $m=/fwd="MASKED"/ ? "[M]":""; /coderbyte heroku/router/ and /request_id=(S+)/ and print "$1 $mn" ' output.log
b19a87a1-1bbb-4e67-b207-bd9f23d46afa
910b07d1-3f71-4347-a1a7-bfa20384ef65
097bf65e-e189-4f9f-9dfb-4758cff411b2
d48278c2-5731-464e-be38-ab9ad84ac4a8
8bb2413c-3c67-4180-8091-000313b8d9ca [M]
10f93da3-2753-48a3-9485-857a93d8a88a [M]

$ awk '/coderbyte heroku/router/{gsub(/request_id=/,"",$10); print $10, ($11=="fwd="MASKED"" ? "[M]" : "")}' web-logs-raw 
b19a87a1-1bbb-4e67-b207-bd9f23d46afa 
910b07d1-3f71-4347-a1a7-bfa20384ef65 
097bf65e-e189-4f9f-9dfb-4758cff411b2 
d48278c2-5731-464e-be38-ab9ad84ac4a8 
8bb2413c-3c67-4180-8091-000313b8d9ca [M]
10f93da3-2753-48a3-9485-857a93d8a88a [M]
$ awk -F'[ ="]' '/coderbyte heroku/router/{print $18, ($21=="MASKED" ? "[M]" : "")}' web-logs-raw
b19a87a1-1bbb-4e67-b207-bd9f23d46afa 
910b07d1-3f71-4347-a1a7-bfa20384ef65 
097bf65e-e189-4f9f-9dfb-4758cff411b2 
d48278c2-5731-464e-be38-ab9ad84ac4a8 
8bb2413c-3c67-4180-8091-000313b8d9ca [M]
10f93da3-2753-48a3-9485-857a93d8a88a [M]

cat web-logs-raw | grep -F "coderbyte heroku/router" | awk '{ print $10 " " $11 }' | xargs -d "=" | awk '{ print $2 " " $4}' | sed 's/"/ /g' | while read a b c; do if [[ "$b" == "MASKED" ]]; then echo $a [M]; else echo $a;fi;done
b19a87a1-1bbb-4e67-b207-bd9f23d46afa
910b07d1-3f71-4347-a1a7-bfa20384ef65
097bf65e-e189-4f9f-9dfb-4758cff411b2
d48278c2-5731-464e-be38-ab9ad84ac4a8
8bb2413c-3c67-4180-8091-000313b8d9ca [M]
10f93da3-2753-48a3-9485-857a93d8a88a [M]