I have logs in this format. I'm looking to get logs only that has count more than 5000.

Matching pattern should be Count [value greater than 5000]

INFO 56783 Count [5987] 
INFO 67988 Count [4986] 
INFO 27679 Count [9865] 

In the above example, the output should be only

 INFO 56783 Count [5987] 

I'm using in the following format

sudo cat <path to log> | grep 'Count [5[0-9][0-9][0-9]]'

Any ideas what is missing here

CodePudding user response：

You may use this grep:

grep -E 'Count \[[5-9][0-9]{3,}\]' file

INFO Count [5987]
INFO Count [9865]

Here regex pattern is \[[5-9][0-9]{3,}\] that matches a:

• \[: Match opening [
• [5-9]: Match digits between 5 to 9
• [0-9]{3,}: Match 3 or more digits
• \]: Match closing ]

This will match 5000 or an integer greater than 5000 inside [...].

However, you should be using awk for this job to get most flexibility:

awk '$2 == "Count" && gsub(/[][]/, "", $3) && $3 0 > 5000' file

INFO Count 5987
INFO Count 9865

CodePudding user response：

You can use

awk -F'[][]' '/Count \[[0-9] ]/ && $2 > 5000' file

The field separator matches ] or [ and /Count \[[0-9] ]/ && $2 > 5000 only outputs lines that contain Count [<number>] and where Field 2 is more than 5K.

See the online demo:

#!/bin/bash
s='INFO Count [5987] 
INFO Count [4986] 
INFO Count [9865] '
awk -F'[][]' '/Count \[[0-9] ]/ && $2 > 5000' <<< "$s"

Output:

INFO Count [5987] 
INFO Count [9865]