Need to filter log to search for the lines from the last 5 minutes

Question

2011-04-13 00:09:07,731 INFO [STDOUT] 04/13 00:09:07 Information...

Hi everyone. I would post some of my code, but I don't even think it's worthy of posting. What I'm trying to do is that I've got a log file with lines like above. What I need to do is take the last lines timestamp, and keep all the lines from the last 5 minutes (rather than the last 200 lines or whatever....which would be easier). Could anyone help? I've searched the web, some decent tips, but still nothing going and frustrated as hell. Thanks!

Answer 1

Here's a simple Perl script that iterates over the file and prints every line whose timestamp is within 5 minutes of the time at the start of execution. For more efficiency, and assuming that the lines are in timestamp order, you could modify this to set a boolean flag when it encounters the first printable line and skip the testing from that point forwards.

#!/usr/bin/perl
use POSIX qw(mktime);

$now = time();
while(<>)
{
    ($yy,$mm,$dd,$h,$m,$s,$t) = /^(\d+)-(\d+)-(\d+)\s+(\d+):(\d+):(\d+),(\d+)/;
    $t = mktime($s+$t/1000, $m, $h, $dd, $mm-1, $yy-1900);
    print "$_" if ($t >= $now-300);
}