regular expression/filters

[Paul Howarth]

On Mon, 2004-08-30 at 04:21, Mr. Oberoi wrote:
> i have been trying to use a filter to test if the
> squid log is in native form or not?
> its not working at all the awk command does not
> execute the if statement within... i dont know what's
> wrong? can some one help!
> 
> echo `awk ' { if($0 ~ "%g %e %a %w/%s %b %m %i %u
> %h/%d %c")

%g etc. are not patterns for regular expression matching of input, they
are print formatting specifications for output.

>                 (echo "file in native squid format!")
>                                                       
>                          
>                 else (echo "not in native form") }
>                                                       
>                          
>                 fi
>                  {print FNR OFS"," $3 $1 $6 $7} ' 
> < $filename > out`
> =================================================
> 
> Is there any other way i can check the format?
> am i on the right track even???

Reliably detecting the format of a squid access log entry could make for
quite a complex regular expression. How robust does it need to be? Are
you just checking to see if it's native or httpd format? If so, you
might get away with just checking one of fields in the record.

Try this (looks for 4th field starting with square bracket):

if head -1 $filename | grep '^[^ ]* *[^ ]* *[^ ]* *[[]' >/dev/null; then
  echo file in httpd format
  awk '{ print FNR "," $1 OFS "x" OFS substr($6,2) OFS $7 }' $filename >
out
else
  echo file in native squid format
  awk '{ print FNR "," $3 OFS $1 OFS $6 OFS $7 }' $filename > out
fi

Paul.
-- 
Paul Howarth <paul at city-fan.org>