How can I retrieve logs between two timeframes using regex? - regex

Question

I have a huge log file, where each line is a log entry with it's own timestamp. How can I retrieve logs in-between two specified timestaps (ie. start time - 22:00:00, end time - 23:00:00)?

Answer 1

Using bash, it is possible to generate a regex statement based only on two input timestamps, which you may pipe to a command (such as grep):
#!/bin/bash
#This is a bare-bone recursive script that accepts input of a start/end timeframe
#in the 24-hour format, based on which a regex statement will be generated that will
#select all values in between those two timeframes. Please note that this script
#has undergone some optimization (I apologize for the reading difficulty, but it
#did not occur to me until now that someone might have a use for such a script).
#You are free to use, distribute, or modify this script to your heart's content. Any
#constructive feedback is welcome. I did my best to eliminate all bugs, but should
#you find any case where the generated regex is INCORRECT for some timestamps, please
#let me know.
echo $0 - Args passed: $1 $2
START_TIME=$(echo $1 | tr -d ":")
END_TIME=$(echo $2 | tr -d ":")
DIFF_CHAR=""
REGEX=""
function loop ()
{
diffcharValue=$1
maxVal=$2
while [ $diffcharValue -lt $maxVal ]
do
REGEX="${REGEX}:[0-5][0-9]"
let diffcharValue+=2
done
}
function regexGen ()
{
diffChar=$1
start=$2
end=$3
if [ $diffChar -le 6 ]; then
regexGen $(($diffChar + 1)) $start $end 0 #the fourth arg acts as a recursion indicaton, whether the function was called recursively or not
let diffChar-=1
diffCharMinusOne=$(($diffChar - 1))
startBegin=${start:0:$diffCharMinusOne}
endBegin=${end:0:$diffCharMinusOne}
startCut=${start:$diffCharMinusOne:1}
endCut=${end:$diffCharMinusOne:1}
endStartDiff=$(($endCut-$startCut))
if [ $(($diffChar % 2)) -eq 0 ]; then
if [ $4 -eq 0 ]; then
REGEX="${REGEX}$startBegin[$startCut-9]"
loop $diffChar 6
REGEX="${REGEX}|$endBegin[0-$endCut]"
loop $diffChar 6
REGEX="${REGEX}|"
elif [ $endStartDiff -gt 1 ]; then
if [ $endStartDiff -eq 2 ]; then
REGEX="${REGEX}$startBegin[$(($startCut+1))]"
else
REGEX="${REGEX}$startBegin[$(($startCut+1))-$(($endCut-1))]"
fi
loop $diffChar 6
echo $REGEX
else
echo ${REGEX%?}
fi
else
if [ $4 -eq 0 ]; then
if [ $startCut -lt 5 ]; then
REGEX="${REGEX}$startBegin[$startCut-5][0-9]"
loop $diffChar 5
REGEX="${REGEX}|"
fi
if [ $endCut -gt 0 ]; then
REGEX="${REGEX}$endBegin[0-$endCut][0-9]"
loop $diffChar 5
REGEX="${REGEX}|"
fi
elif [ $endStartDiff -gt 1 ]; then
if [ $diffCharMinusOne -gt 0 ]; then
REGEX="${REGEX}$startBegin"
fi
if [ $endStartDiff -eq 2 ]; then
REGEX="${REGEX}[$(($startCut+1))][0-9]"
else
REGEX="${REGEX}[$(($startCut+1))-$(($endCut-1))][0-9]"
fi
loop $diffChar 5
echo $REGEX
else
echo ${REGEX%?}
fi
fi
fi
}
for a in {0..5}
do
if [ ${END_TIME:$a:1} -gt ${START_TIME:$a:1} ];then
DIFF_CHAR=$(($a+1))
break
fi
done
result=$(regexGen $DIFF_CHAR $START_TIME $END_TIME 1 | sed 's/\([0-9][0-9]\)/\1:/g')
echo $result