主页 / 问题 / 1115060
Accepted
Mikhail Murugov
Asked:2020-04-24 19:24:19 +0000 UTC2020-04-24 19:24:19 +0000 UTC

从日志中获取完整的有效 json

  • 772

有一个系统Linux。它有一个日志。在此日志中有一个有效的json. 这json一个被分成几行。我确定这里面有一个值为 的json键。如何从此日志中获取包含此键和值的全部内容？阅读日志本身没有问题，只需将其拉出即可。 "id"12345jsonjson

我试过的：

grep -zo "{.*\"id\".*12345.*}" log.log
grep -ez "{.*\"id\".*12345.*}" log.log

不幸的是，我没有得到想要的结果。

测试日志示例：

2020-04-24 14:00:58.870+0300:Another string
2020-04-24 14:00:58.872+0300:Unusual json: {"some data": "another data"}
2020-04-24 14:00:58.891+0300:Answer from some service: {
 "event_id":"some id"
, "some information":"some value"
, "id":12345
, "timestamp":1587726058000
, "status":"ok"
,"some integer":100
, "category_scores":[
 {"id":"id1","value":123},
 {"id":"id2","score":234},
 {"id":"id3","score":100},
 {"id":"id4","score":299},
 {"id":"id5","score":600}
]
, "result":{"action":"some action","param":"0","action_code":"allow"}
, "service":{"request_id":1448
}}

从这个例子你应该得到：

{
 "event_id":"some id"
, "some information":"some value"
, "id":12345
, "timestamp":1587726058000
, "status":"ok"
,"some integer":100
, "category_scores":[
 {"id":"id1","value":123},
 {"id":"id2","score":234},
 {"id":"id3","score":100},
 {"id":"id4","score":299},
 {"id":"id5","score":600}
]
, "result":{"action":"some action","param":"0","action_code":"allow"}
, "service":{"request_id":1448
}}
linux

1 个回答

  1. Best Answer

    假设我们有一个 log.log 文件，它包含您的文本

    然后命令看起来像这样

    cat log.log  | \
 sed -e "s/^\([0-9]\+\).*{/{/g" | \ 
 sed -e "s/^\([0-9]\+\).*//g" |  \
 tr -d '\n' \
 | jq " .| select(.id  == 12345)"
    1. 删除所有以数字开头且为 { 的行，留下符号 {
    2. 删除所有以数字开头的行
    3. 删除校正器以使其更容易标准化
    4. 我们只选择那些父参数.id为 的 JSON，其中值为 12345

    全部的

    {
  "event_id": "some id",
  "some information": "some value",
  "id": 12345,
  "timestamp": 1587726058000,
  "status": "ok",
  "some integer": 100,
  "category_scores": [
    {
      "id": "id1",
      "value": 123
    },
    {
      "id": "id2",
      "score": 234
    },
    {
      "id": "id3",
      "score": 100
    },
    {
      "id": "id4",
      "score": 299
    },
    {
      "id": "id5",
      "score": 600
    }
  ],
  "result": {
    "action": "some action",
    "param": "0",
    "action_code": "allow"
  },
  "service": {
    "request_id": 1448
  }
}

    ps 但是如果日志太大，那么最好这样做sed -i filename

    • 1

相关问题