mjhjmtu

Been trying to figure this one out for a while now. Went through this site and googled like crazy. It would be greatly appreciated if someone could help.

I have some log files with no headers and columns are all over the place. Meaning that an item like src=4.2.2.2 could be anywhere in the file. All objects in the file do have a something=xxx format.

Example Log:

src=1.1.1.1 sport=12312 dport=80 message=hacked

dport=443 src=2.2.2.2 message=null sport=32432

message=clean dport=21 sport=43434 src=3.3.3.3

I have used the match() function, but am trying to pull out multiple fields.

gawk 'match($0, "src=([^ ]+)") print substr($0, RSTART, RLENGTH) ' file

gives me the following:

src=1.1.1.1

src=2.2.2.2

src=3.3.3.3

I would like to have multiple fields like src, dport and message so the output lines up and looks like the following:

src=1.1.1.1 dport=80 message=hacked

src=2.2.2.2 dport=443 message=null

src=3.3.3.3 dport=21 message=clean

Is this possible with gawk or something else?

Thanks!

Awk solution (independent of item positions):

awk 'function get_item(name) 
 match($0, name"=[^[:space:]]+"); 
 return substr($0, RSTART, RLENGTH) 
 
 print get_item("src"), get_item("dport"), get_item("message") ' file

With the above approach you are able to output the crucial needed items in any order.

The output:

src=1.1.1.1 dport=80 message=hacked
src=2.2.2.2 dport=443 message=null
src=3.3.3.3 dport=21 message=clean

With GNU awk (NOTE: this relies on the lexical sort order of the "key" strings):

gawk 'split($0,a); asort(a); printf("%st%st%sn", a[4], a[1], a[2])' file
src=1.1.1.1 dport=80 message=hacked
src=2.2.2.2 dport=443 message=null
src=3.3.3.3 dport=21 message=clean