Question

I am trying to use gawk to extract paragraphs from a log and it is working perfectly up to the point where I want to include the record separator it found.

This is the command:

gawk --re-interval 'BEGIN{RS="[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}.[0-9]{1,6} \\[[A-Z]*\\]";} /983a99f8-bec6-11e1-80dd-059a821d0b73/ {print $0}' full.log 

If I add in print RT, $0, it prints the RT of the next match not the current match.

This is some sample text

9:08:06.899627 [DEBUG] <0.30065.3>@agent:1565 Recs to loop through:  [{agent_state,"OpenAcdAgent43","Jeff",
                            undefined,wrapup,
                            {call,"983a99f8-bec6-11e1-80dd-059a821d0b73",
                                voice,
                                {"8501112234","MorganGrimes"},
                                "9201",<0.30392.3>,[],
                                {client,"8221314","DCF",[],1340629596,
                                    1340629596},
                                [creole_general],
                                <0.30398.3>,outband,inband,inbound,10},
                            1340629658,undefined,"Default",1340629658
9:08:06.899707 [INFO] <0.168.0>@cpx_monitor:649 Down message for reference #Ref<0.0.16.137225> of <0.30064.3> due to normal

What I want to be 9:08:06.899627 [DEBUG] able to do is prepend 9:08:06.899627 [DEBUG] to my match but RS takes that away. I get 9:08:06.899707 [INFO] instead.

Thanks!

Answer 1

That’s because a record separator comes at the end of a record. So 9:08:06.899627 [DEBUG] is the end of an empty record and 9:08:06.899707 [INFO] is the end of the record that matches your GUID regex.

You need to save the previous RT and output the saved one.

gawk --re-interval 'BEGIN{RS="[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}.[0-9]{1,6} \\[[A-Z]*\\]";} /983a99f8-bec6-11e1-80dd-059a821d0b73/ {print savedRT, $0} {savedRT = RT}' full.log