grep常用过滤

前后行 A B C

grep -A 显示匹配指定内容及之后的n行

grep -B 显示匹配指定内容及之前的n行

grep -C 显示匹配指定内容及其前后各n行

cs@debian:~/oss/hexo$ cat /opt/nginx/logs/k8s-access.log | grep -C 5 "2022:15:43:27"
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:22 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:23 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:24 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:25 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:26 +0800] 502 0
127.0.0.1 - 192.168.56.103:6443, 192.168.56.101:6443, 192.168.56.102:6443 - [31/Jul/2022:15:43:27 +0800] 502 0, 0, 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:28 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:29 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:30 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:30 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:31 +0800] 502 0

与操作

多次匹配

cs@debian:~/oss/hexo$ cat /opt/nginx/logs/k8s-access.log | grep "2022:15:43:2" | grep 502
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:20 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:21 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:21 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:22 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:23 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:24 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:25 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:26 +0800] 502 0
127.0.0.1 - 192.168.56.103:6443, 192.168.56.101:6443, 192.168.56.102:6443 - [31/Jul/2022:15:43:27 +0800] 502 0, 0, 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:28 +0800] 502 0
127.0.0.1 - k8s-apiserver - [31/Jul/2022:15:43:29 +0800] 502 0

或操作 |

cs@debian:~/oss/hexo$ cat /opt/nginx/logs/k8s-access.log | grep "502\|15:43:3\|kube-apiserver"

grep -E “502|15:43:3|kube-apiserver”

egrep “502|15:43:3|kube-apiserver”

awk “502|15:43:3|kube-apiserver” file

特殊字符 fgrep

搜索文件包含正则表达式元字符串时,例如$、^、/等，fgrep很有用

cs@debian:~/oss/hexo$ egrep "^Hello"  12
cs@debian:~/oss/hexo$ grep "^Hello"  12
cs@debian:~/oss/hexo$ fgrep "^Hello"  12
^Hello\

它不解析正则表达式、想搜什么就跟什么

压缩文件 zgrep

zgrep  pattern1  ./*   |  grep  pattern2

zegrep

zcat file1.gz file2.gz

xargs

参数传递

xargs -I和xargs -i是一样的，只是-i默认使用大括号作为替换符号，-I可以指定其他符号、字母、数字作为替换符号，但最好是用引号包起来

 ❯ brctl show | grep br- | awk '{print $1}' | xargs -i echo {}
br-0ab30bce63a6
br-3752fdd6ce99

 
 ❯  brctl show | grep br- | awk '{print $1}' | xargs -i echo "if {} down"
 if br-0ab30bce63a6 down
 if br-3752fdd6ce99 down

在命令中不能使用{}，例如touch {1...10}.log时

❯  brctl show | grep br- | awk '{print $1}' | xargs -I '#' echo "sudo ifconfig # down"

brctl show | grep br- | awk ‘{print $1}’ | xargs -I / echo “sudo ifconfig / down”

分割

使用 -d 命令指定分隔符

❯ brctl show | grep br- | awk '{print $1}' | xargs -d -
br 0ab30bce63a6
br 3752fdd6ce99

-E 截取 （-E 选项在使用了 -0 或 -d 选项时不生效）

❯ brctl show | grep br- | awk '{print $1}' | xargs  -E br-a489d33c0217
br-0ab30bce63a6 br-3752fdd6ce99 br-584f6987ca12 br-5fd932453df0 br-61f46a216249 br-6777048fb40b br-8f1afcbb751d 

指定的命令行参数之前的参数(不包括-E指定的这个参数br-a489d33c0217)

该参数前后空格才能匹配

划批

-n 每次传递几个参数给其后面的命令执行

❯ brctl show | grep br- | awk '{print $1}' | xargs -E br-a489d33c0217 -n 3
br-0ab30bce63a6 br-3752fdd6ce99 br-584f6987ca12
br-5fd932453df0 br-61f46a216249 br-6777048fb40b
br-8f1afcbb751d