Search code examples
awksedgrepcut

Remove N characters after matching string from Fortigate logfile


Looking for a way to remove characters after the matching string

Example data:

srcip=10.1.100.11 srcport=58012 srcintf="port12" srcintfrole="undefined" dstip=23.59.154.35 dstport=80

Desired Output:

srcip=10.1.100.11 srcport= srcintf="port12" srcintfrole="undefined" dstip=23.59.154.35 dstport=80

Here I'm looking to remove the characters after srcport=' '. In this case it will always be 6 characters. But it would be nice to account for all characters after = until the space starts before srcintf.

There are quite a few examples of removing everything before or after the match, but can't find an example for what I'm looking for.


Solution

  • Using gnu sed, match scrport= followed by digits and replace with srcport=:

    $ sed 's/srcport=[[:digit:]]\+/srcport=/' file
    srcip=10.1.100.11 srcport= srcintf="port12" srcintfrole="undefined" dstip=23.59.154.35 dstport=80