Thursday, October 6, 2022

[SOLVED] How to Search in Linux if ERROR changes to INFO in logs for a particular ID

Issue

I have a log as below. I need to filter out only ERROR lines for which REQ ID is repeatedly in ERROR state.

As for Example in below case, expected output is REQ3 as it is in ERROR state in line 3 and again after retry it is in ERROR. ( There can be infinite retries but we can check for like in a day it is continuously in ERROR) for REQ2 , it was in ERROR state in line 2 but changed to INFO in line 5, so it is not expected in output.

....

yyyy-mm-dd [INFO] REQ1 Context 1
yyyy-mm-dd [ERROR] REQ2 Context 2
yyyy-mm-dd [ERROR] REQ3 Context 3
yyyy-mm-dd [INFO] REQ1 Context 4
yyyy-mm-dd [INFO] REQ2 Context 5
yyyy-mm-dd [ERROR] REQ3 Context 6

....


Solution

This awk command should do the job:

awk '
    { if ($2=="[ERROR]") errors[$3]; else cleared[$3] }
    END { for (id in errors) if (!(id in cleared)) print id }
' file


Answered By - M. Nejat Aydin
Answer Checked By - Marie Seifert (WPSolving Admin)
at