Question

The following command is working as expected. What I need to find is the thread id that is available in the first or third column.

# tail -1000 general.log | grep Connect | egrep -v "(abc|slave_user)"
                2856057 Connect root@localhost on 
111116  5:14:01 2856094 Connect root@localhost on 

If the line starts with the date, select the third column i.e. 2856094 or the first column i.e. 2856057

Expected output:
2856057
2856094

Answer 1

Another way to look at it is that you always take the fourth column when counting from the right:

awk '{ print $(NF-3) }'

Otherwise, if the date is really the only reliable indicator, try this:

awk -v Date=$(date "+%y%m%d") '$1 == Date { print $3; next } { print $1 }'