Grep Regex Log Analyzer Tool For Mac
AJC Grep - 1.3: AJC Grep is a powerful file finder, text search, replace and data extraction program for Windows. This is a major time saving tool for developers, documenters, web designers and anyone who has to search and replace in a large number of files. Grep will not match since there i. Stack Exchange Network Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. The original regular expressions application, grep, is a part of Darwin and is right at your fingertips via the Terminal. Grep is also included in Unix and MacOS X-based text editors and even some word processors. With a bit of practice, you'll be using grep and regular expressions to find anything you want. Kirk McElhearn is the author of The Mac OS X Command Line: Unix Under the Hood (Sybex, 2004).
The grep program is a standard UNIX utility that searches through a set of files for an arbitrary text pattern, specified through a regular expression. Also check the man pages as well for egrep and fgrep. Mgrep is a command line tool that allows users to search text files for lines matching a given regular expression. It is similar to the well-known Unix utility, grep.As a natural extension to the single-line regular expressions, mgrep is also capable of searching for multiline patterns.
It's fast, it's powerful, and its very name suggests that it does something technical: grep. With this workhorse of the command line, you can quickly find text hidden in your files. Understanding grep is the first step in joining the guild of command-line wizards.
Why Not Use the Finder?
It's easy to find files with the Finder when you know their names. But the grep command is a time-saver when you're trying to find what's inside files. You can use grep easily from the command line to search for specific text, and you'll get results in seconds. (You can also use grep within certain text editors.)
The Finder offers a similar function: the Find By Content search. (Press Command-F in the Finder, select Content in the Search For Items Whose pop-up menu, and enter a search string in the text field.) But the Finder searches only inside files it has indexed, and it ignores hidden system files unless you expressly choose to search for visible and invisible files and add your System folder to the search.
The Finder also lacks grep's flexibility: while it's good for searching for a specific word (for example, Walden ), it becomes less useful when you want to find a longer string. Search for Walden Pond, and it returns all files that contain either Walden or Pond.
Using grep also gives you access to regular expressions. These combinations of letters, numbers, wild cards, and other special characters let you find much more than mere words. You can search for just about any string of characters: IP addresses in log files; phone numbers in contact lists; or specific strings containing a series of numbers, letters, or other characters. Using regular expressions, you're limited only by your imagination.
Log Analyzer Tool
Get a Grip on Grep
The grep command looks inside one or several files for the string, or text, you specify. Its syntax is: grep options search_string file..
.
At its most basic, you tell grep what to look for and where: grep AppleTalk /etc/services
, for example. Here, you tell grep to look for AppleTalk in the services file located in the /etc directory. (This useful file contains a list of network port numbers for commonly used services.) The command displays each line that contains your search string:
And so on. You can use the familiar asterisk (*
) wild card to have grep search a group of files in the current working directory, as in grep Walden *
. This command searches all the files in the current directory for the word Walden, returning the following:
And so on. As the above example shows, the search returns several matches. The first, Walden.doc, is a Word file. The grep command calls such proprietary file types binary files. It can't display the contents of binary files, but it can search inside them and tell you if something matches. The next examples come from plain-text files, for which grep can display the results. You see the file name, followed by a match of the search string in its context.
You can search for any multiword text string by enclosing the string in single quotes. For example, if you want to search for the phrase Walden Pond,you'd type grep 'Walden Pond' *
.
Note that grep doesn't like Macintosh line breaks. It returns lines containing the search string, but it doesn't see Mac line breaks as anything other than characters. In such a case, the “line” it returns is the entire file; this can dump a lot of text into your Terminal window.
In the previous example, grep ran in a specific folder, checking all the files it contained. What if you want to run grep on a folder and its subfolders, or you want grep to look for the string regardless of case? You need to add options. For example, to search for Waldenanywhere in a folder or its subfolders, use the-r
(recursive) option: grep -r Walden ~/Documents/*
.
Fine-Tune Your Searches
To Find… | Use This Option | Example |
---|---|---|
Text in subfolders | -r | grep -r Walden ~/Documents/* Finds Walden in any file in any subfolder of ~/Documents. |
Whole words only | -w | grep -w live Finds only live ; does not find liver , lives , lived , and so on. |
Case-insensitive text | -i | grep -i pond Finds pond , POND , or Pond . |
File names only | -l | grep -l Walden Finds files containing Walden , but returns only a list of file names. |
Number of occurrences only | -c | grep -c Walden Returns the names of files containing Walden and the number of hits in each file. |
The grep command has several options that let you fine-tune the way you search for text, as well as the kind of results grep returns. Get started with the helpful options listed here. (Note that you can also combine options—for instance, grep -rl Walden
searches subfolders and returns only a list of files containing the word Walden .)
Search for Multiple Strings
Using the pipe (), a Unix redirection operator, you can tell grep to search for more than one string. Say you want to find files containing both Walden and Pondon the same line. You'd use this command:
grep Walden * grep Pond
. The first part of the command looks for the word Walden in any files in the current directory, and the second runs another grep command on the results of the first command. Terminal displays only the final results of the two commands combined.
You could string together many grep commands, like this:
. This command looks in a special dictionary file for words containing the lowercase letter a. It then looks for words containing e in the results, and so on, finally returning only those words that contain all five vowels.
This function of grep is most useful when you're searching for specific strings in output from other commands. In this way you can whittle down long and complex output. For example, here's a common way to find the process ID of a program that's stuck so you can force-quit it from the command line: type ps -ax grep Finder
.
This command first gets a list of all processes running on your Mac, and then sifts through this list looking for lines containing the word Finder. For example, your results might be as follows:
The process ID is the first number on each line; here, the Finder is 390. (You'll notice the command also returns itself; since the word Finderis in the grep command, that gets listed as well.) So if the Finder is stuck, this gives you the information you need to force-quit it. Now you would type the command (where the process ID is the final argument) kill -9 390
.
Add Regular Expressions to the Mix
While you have seen some of the power of the grep command, you can go much further using regular expressions, special combinations of characters that act as wild cards. Here are a few examples.
If you're not sure how to spell the word separate, for example (is that an a or an e?), run this command to check the special dictionary file hidden in your Mac's entrails:
You'll get back a list of words that includes separate, separately, separately, separateness, and separates.
Note the two special characters in the command: the caret (^
) and the dot (.
). The caret tells grep to search for the string at the beginning of a line, so the results don't include words like inseparate. The dot matches any character except a new line.
What if you want to find all the phone numbers in a specific file? Try this command, which will find phone numbers in the 555-1234 format:
.
Each of the[0-9]
wild cards matches any character in the range specified in brackets. You can use ranges such as[1-3]
to limit your search to specific strings. This works for letters, too:[a-n]
matches any lowercase character from a to n.You can build your own range with sets of characters—for example, [aeiou]
will match only vowels. You can learn more about regular expressions by typingman grep
in Terminal, or by consulting Jeffrey Friedl's excellent book Mastering Regular Expressions, second edition (O'Reilly, 2002). With a bit of practice, you'll be using grep and regular expressions to find anything you want.
Kirk McElhearn is the author of The Mac OS X Command Line: Unix Under the Hood (Sybex, 2004). His blog, Kirkville, has articles and tips on using the command line with Mac OS X. ]
I have a log file with entries like the following:
Input
Output
What I'm trying to do is match all lines from a log file unless - it contains php
followed by error
or notice
. If it contains php
followed by error
or notice
, then it should only match if winner
is also in the string. My regex-foo is weak. Thanks.
2 Answers
Grep Regex Linux
Use this: grep 'phps+(error notice).*winner' mylogfile
Grep Regex Match
Uml diagram tool for flash magic. There might be a way to get grep to pull that off in one string but I think personally I'd make it script to handle that in either perl or bash.In bash it would be something like
I don't have a system handy to test/debug this right now, so you may have to tweak it a bit.