Grep doesn’t work with both -v and -A/B

grep

So I'm trying to use grep with both -v argument and -A argument.

So my file has text like:

This error
-this
-this
-that
[text I want]
This error
-asd
-asfag
-adsfhs
[text I want]
[text I want]
This error
-asdgsda
-asdgg
-gasdg

After a tail, I found out that this log file is filled with the same This error followed by 3 lines construct, and I can easily find them by using grep -A3 'This error', this shows me the error and the 3 lines after it.

But I want to see everything OTHER than that, hence the -v argument, but it doesn't work. When I do grep -v -A3 'This error' it returns the whole file, like grep didn't even work at all.

What is the problem here?

Best Answer

If you can use sed instead of grep, it provides a nice solution:

sed -e '/This error/,+3d' myfile

This removes the line containing the string This error and the following three lines, but outputs everything else. This sed command requires GNU sed (the +3 address is an extension).

Related Solutions

Using grep to show entries that match a pattern and are present at least X times

sed < mail.log -n 's/.*auth failed.*rip=\([^,]*\).*/\1/p' |
  sort |
  uniq -c |
  awk '$1 >= 3' |
  sort -rn

Would give you the matching IP addresses with their number of occurrence sorted by number of occurrence.

Grep log and get text between log delimiters

If you know how big the record is, then you can output additional lines of context before (-B) and after (-A) the matching line e.g.

grep -A2 -B2 'Fields' sample.log

or for context both before and after the match line

grep -C3 'Fields' sample.log

As far as I know, the only way to do a true multiline match (rather than a single line match plus context) in GNU grep is by using the PCRE regex mode (-P) with the -z flag to prevent breaking on newlines. For example, you could try

grep -zPo '(\n-+\n)\K(.|\n)+?Fields(.|\n)+?(?=\n-+\n)'

which does a non-greedy match of the string Fields surrounded by any characters OR newlines, provided it is bookended by the newline-hyphens-newline delimiters. An equivalent expression in pcregrep is

pcregrep -Mo '(\n-+\n)\K(.|\n)+?Fields(.|\n)+?(?=\n-+\n)'

Another option for this kind of record-structured data is awk: in particular, GNU awk allows a regular expression to be used for the internal record separator RS e.g.

$ gawk -vRS='\n-+\n' '/Fields/ {print}' sample.log

r132279 | USERID | 2014-04-30 12:59:09 -0700 (Wed, 30 Apr 2014) | 3 lines

Removed unused "Calculated Fields" column entry.

Jira ID: JIRA-977

Best Answer

Related Solutions

Using grep to show entries that match a pattern and are present at least X times

Grep log and get text between log delimiters

Related Question