Using awk to extract IPs with exact match on string?

[Aknot]

Is there a way to use a exact match on the condition in awk?

This is what I have:

awk '$11 == "200" && index($9, "/example") {print $1}' /var/log/httpd-access.log | sort -n >> /tmp/ips.list

This catches /anotherdirectory/example too as it contains /example.

Is there a way to prevent this?

Thanks

 

[VladiBG]

awk '$11 == "200" && $9 == "/example" {print $1}' /var/log/httpd-access.log

or

try with ^ (start of the line) $ (end of the line)

^\/example$

awk '$11 == "200" && $9~/^\/example$/ {print $1}' /var/log/httpd-access.log

$11 - column 11
== string comparison equal
"200"

&& logical and

$9 - column 9
~ regex match
/ start of the regex
^ start of the line
\/ escape "/" character
example search string
$ end of the line
/ end of the regex

You can test it here with:

/dir1/example
/example

regex101: build, test, and debug regex

Regular expression tester with syntax highlighting, explanation, cheat sheet for PHP/PCRE, Python, GO, JavaScript, Java, C#/.NET, Rust.

regex101.com

Btw my column numbers are different in httpd-access.log

awk '{for (i=1;i<=NF;i++) print "Column "i" : " $i ""} NR==3{exit}' /var/log/httpd-access.log

 

[Aknot]

Great!! Thanks for your help and tips, much appreciated!!

I guess I actually need it to match from the start of the line, so I removed the $ character.
I'll hope that will do the trick:

awk '$11 == "404" && $9~/^\/example/ {print $1}' /var/log/httpd-access.log | sort

 

[VladiBG]

this will not be the exact match. It will match anything starting with "/example"

/example
/example1/
/exampletest
etc

 

[Aknot]

OK I see, thanks for pointing that out! But it wont checking for a match inside long directory structures, like the old one i had?

/tools/hammers/example/thor

 

[SirDice]

It will skip strings that do not start with /example, so it won't match /tools/hammers/example/thor, but it will match /examplesomething_else.

If you want to match exactly /example, you could regex ^\/example$

^ matches the beginning of the string, $ matches the end of a string. If you want to match with a / at the end, that may or may not be there, you could use ^\/example(\/)?$

Regular Expressions

 

[Aknot]

It will skip strings that do not start with /example, so it won't match /tools/hammers/example/thor, but it will match /examplesomething_else.

Great, thanks! I think I got it now

 

[sko]

^ matches the beginning of the string, $ matches the end of a string.

More precisely: s/string/line/
At least for awk/sed/grep which work on a per-line basis by default.

So ^\/example$ would match a line that *only* contains /example and nothing else (not even spaces before/after)

If you find yourself bashing (a lot of) text data for ip addresses on a regular basis, it might be worth looking at Perl and the Net::IP extension. Perls syntax is somewhat of a mix of bourne shell, awk/sed and some C sprinkled on top - so anyone already used to write shell and/or awk scripts will feel right at home.