Using shell to extract IDs from a server log?

user_13073762 0
Viewed 58

I have the following blob repeated many times within a file that has so sensible delimiter:

"2020-05-12T07:51:56,071Z FATAL [] [message=Failed to process event xyz::5bf0726d-5927-32d0-92b3-5c741d9c15ec : association failed for the the id xyz::5bf0726d-5927-32d0-92b3-5c741d9c15ec , part (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: ValidationException; Request ID: )] ... splunkcloud.com,

Something like.. (xyz::[0-9A-Za-z-]+)

I specifically would like to extract the ID xyz::5bf0726d-5927-32d0-92b3-5c741d9c15ec from this log (which is continuously repeating. The value can end in an alphanumeric and it always starts with xyz::.

I ultimately want to cat the file in shell and run in through something like awk/sed so I can have just a line delimited file of these IDs. Thanks.

sed awk regex
1 Answers

You can use grep:

grep -o 'xyz::[[:xdigit:]]\{8\}\(-[[:xdigit:]]\{4\}\)\{3\}-[[:xdigit:]]\{12\}' file

[:xdigit:] is a POSIX character class that matches a-f, A-F, or 0-9 characters. \{8\} matches eight occurrences. \(-[[:xdigit:]]\{4\}\)\{3\} matches three blocks of - hyphen followed with 4 xdigit characters. The match ends with - and 12 xdigit characters.

user_113298900
Related