substrings in lines

Question

I have many log files

workstation_2020_10_30-230600.log
workstation_2020_11_01-143352.log
workstation_2020_11_02-123203.log
workstation_2020_11_02-181803.log
workstation_2020_11_02-194433.log
workstation_2020_11_02-203701.log

with lines like this

I 06Nov20 13:48:11.838: PrintConsole    PrintConsole(1) unknown 0   2386    ExposureStatusChanged: ExposureId=2386,ExposureName=foobar.tif,ExposureStatus=Successful,PercentComplete=100,GroupingCount=30,OrderingTimeout=0,IsComplete=True

I want to inspect all lines where the substring IsComplete=True is found to extract the timestamp and the name of the exposure file (stated after ExposureName=).

For the above example, the output should look like

06Nov20 13:48:11 foobar.tif

My best result is

cat workstation/* | grep tif.*IsComplete=True | cut -d '=' -f 3 | cut -d ',' -f 1 | sort


foobar.tif
foobar2.tif
foobar3.tif
...

which doesn't give me the timestamp. I don't know how to proceed easily without writing loops and functions...

Answer 1

Assuming you have GNU awk for the third argument to match(), the following program comes to mind:

awk '/IsComplete=True/{match($0,"ExposureName=([^,]+)",a); print $2,$3,a[1]}' *.log

This will match all lines containing the string IsComplete=True and extract the pattern "ExposureName=, followed by any characters that are not the ,", and place the latter part (which is the filename) in a capture group that will be stored in the array variable a.

It will then print the second and third "word" (space-separated field) which contain date and time, and then the content of the capture group from the match() call.

For your example, I get

06Nov20 13:48:11.838: foobar.tif

If you want to get rid of the ms-part of the timestamp, you can use gensub() to modify that field:

awk '/IsComplete=True/{match($0,"ExposureName=([^,]+)",a); print $2,gensub(/\..*$/,"","1",$3),a[1]}' *.log

Please be aware that the numbering of the fields ($2, $3) depends strongly on the presence/absence of spaces, because this is how awk splits a line into fields by default; so if the timestamp format were ever to change (e.g. to 06 Nov 20), you would need to adapt the syntax in the print statement.

Answer 2

Using sed:

sed -E '/IsComplete=True/{
     s/^[^ ]* ([^.]*)\..*ExposureName=([^,]*),.*/\1 \2/;
}' *.log