1

I have a file which contains firewall log like this: 

Feb             3       0:18:51 17.1.1.1                      id=firewall     sn=qasasdasd "time=""2018-02-03"     22:47:55        "UTC""" fw=111.111.111.111       pri=6    c=2644        m=88    "msg=""Connection"      "Opened"""      app=2   n=2437       src=12.1.1.11:49894:X0       dst=4.2.2.2:53:X1       dstMac=42:16:1b:af:8e:e1        proto=udp/dns   sent=83 "rule=""5"      "(LAN->WAN)"""

I need to get an output which should be like this:

src=ipaddress:port , dst=ipaddress:port , proto=udp/dns

Specifically, for the above input,

src=12.1.1.11:49894,dst=4.2.2.2:53,proto=udp/dns

I tried

cat logfile.txt | awk '{ print $18" "$19" "$21 }'

but result seems to different from what I expect.

Rui F Ribeiro
  • 56,709
  • 26
  • 150
  • 232
user356831
  • 125
  • Worth showing what you'd expect the output to be, given the example input you've cited. Oh, and worth adding what you've tried already. – steve Jun 07 '19 at 21:33
  • src=12.1.1.11:49894,dst=4.2.2.2:53,proto=udp/dns is the output i expect – user356831 Jun 07 '19 at 21:35
  • cat logfile.txt | awk '{ print $18" "$19" "$21 }' is what i was trying but result seems to different from what i expect. – user356831 Jun 07 '19 at 21:37

2 Answers2

1

Based on what you have:

awk '{print $18,$19,$21}' OFS=" , " logfile.txt | sed 's|:X[0-1]||g'

You don't need cat as awk already writes to stdout. The command above prints those fields separated by a space which is what the comma does and then it sets the field separator as a comma surrounded by spaces and uses sed to remove :X0 and :X1.

The output:

src=12.1.1.11:49894 , dst=4.2.2.2:53 , proto=udp/dns
Nasir Riley
  • 11,422
1

Using grep:

$ grep -o '\(src\|dst\)=[^:]\+:[^:]\+\|proto=[^ ]\+' logfile.txt
src=12.1.1.11:49894
dst=4.2.2.2:53
proto=udp/dns

Description:

  • '\(src\|dst\)= match src or dst followed by =
  • [^:]\+:[^:]\+ one or more non-colon characters, followed by :, followed by one or more non-colon characters
  • \| or
  • proto=[^ ]\+' match proto= followed by one or more non-space characters

We can glue the newlines together with paste:

$ grep -o '\(src\|dst\)=[^:]\+:[^:]\+\|proto=[^ ]\+' logfile.txt | paste -s -d,
src=12.1.1.11:49894,dst=4.2.2.2:53,proto=udp/dns
Freddy
  • 25,565