Skip to content

Instantly share code, notes, and snippets.

@shahzaibalikhan
Last active May 15, 2020 12:54
Show Gist options
  • Save shahzaibalikhan/2696011076113e1cb72901388f6e0994 to your computer and use it in GitHub Desktop.
Save shahzaibalikhan/2696011076113e1cb72901388f6e0994 to your computer and use it in GitHub Desktop.
Using AWK to dissect ELB logs

Take slice of logs by time

zgrep 'T18:' -r $PWD >> /tmp/logs

Print logs (time, request_url, elb status, target_status)

awk '{print $2 "\t" $14 "\t" $9 "\t" $10}' /tmp/logs

Filter logs by 5XX status of ELB

awk '$9 > 499 {print $2 "\t" $14 "\t" $9 "\t" $10}' /tmp/logs

Write 5XX status logs to separate file

awk '$9 > 499 {print $2 "\t" $14 "\t" $9 "\t" $10}' /tmp/logs >> /tmp/logs5XX

Count total 5XX requests

awk '{print $1 "\t" $2 "\t" $3 "\t" $4}' /tmp/logs5XX | wc -l

Count non interesting Favicon requests

awk '$2 ~ /favicon/ {print $1 "\t" $2 "\t" $3 "\t" $4}' /tmp/logs5XX | wc -l

Filter logs by using regex on URL path

awk '$2 ~ /some_reg_ex/ {print $1 "\t" $2 "\t" $3 "\t" $4}' /tmp/logs5XX | wc -l

Count unique requests by removing query parameters from URL

awk '{ sub(/\?(.*)$/, "", $2); print $2}' /tmp/logs5XX | sort | uniq -c

Get first and last row to get duration of timeline

(head -n1 && tail -n1) < /tmp/logs5XX
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment