How to grep a log file within a specific time period


I have a log file, each line in the log is prepend with a date, like so:

2012-03-06 11:34:48,657 blah blah blah...

How do I grep this file and get only the lines from 8am to 11pm only?

My intention is I want to count the number of errors happening within 8am to 11pm.

Best Answer

egrep '^[^ ]+ (0[89]|1[0-9]|2[012]):'

Detailed explanation can be found in various regex (regular expression) tutorials; egrep uses "POSIX extended" syntax (man 7 regex).

  • The first ^ means "start of the line".

  • [^ ]+ just matches the date field, regardless of the actual date.

    • [...] means "any character between the brackets", so [89] will match either 8 or 9; [0-9] is any number, and [^ ] is anything except a space (because of the ^ inside brackets).

    • + means "one or more of the previous" (for example, a+ would match a, aaa, and aaaaaaaa).

    • So ^[^ ]+ will start with the beginning of line, and match as many non-space characters as it can.

  • (...|...|...) means "either of the given patterns", so (0[89]|1[0-9]|2[012]) means "either 0[89] or 1[0-9] or 2[012]". It will match all numbers from 08 to 22.

A somewhat better option is:

awk -F'[: ]' '$2 >= 8 && $2 <= 22 { print }'

The -F option splits every line into separate fields according to the [: ] regex (matching either : or a space), and the awk script checks the 2nd column (the hour).