I have logs in this format. I'm looking to get logs only that has count more than 5000.
Matching pattern should be Count [value greater than 5000]
INFO 56783 Count [5987]
INFO 67988 Count [4986]
INFO 27679 Count [9865]
In the above example, the output should be only
INFO 56783 Count [5987]
I'm using in the following format
sudo cat <path to log> | grep 'Count [5[0-9][0-9][0-9]]'
Any ideas what is missing here
You may use this grep:
grep -E 'Count \[[5-9][0-9]{3,}\]' file
INFO Count [5987]
INFO Count [9865]
Here regex pattern is \[[5-9][0-9]{3,}\] that matches a:
\[: Match opening [[5-9]: Match digits between 5 to 9[0-9]{3,}: Match 3 or more digits\]: Match closing ]This will match 5000 or an integer greater than 5000 inside [...].
However, you should be using awk for this job to get most flexibility:
awk '$2 == "Count" && gsub(/[][]/, "", $3) && $3+0 > 5000' file
INFO Count 5987
INFO Count 9865
grep for values < 5000, use grep -E 'Count \[([0-9]|[1-9][0-9]{1,2}|[1-4][0-9]{3})\]' fileYou can use
awk -F'[][]' '/Count \[[0-9]+]/ && $2 > 5000' file
The field separator matches ] or [ and /Count \[[0-9]+]/ && $2 > 5000 only outputs lines that contain Count [<number>] and where Field 2 is more than 5K.
See the online demo:
#!/bin/bash
s='INFO Count [5987]
INFO Count [4986]
INFO Count [9865] '
awk -F'[][]' '/Count \[[0-9]+]/ && $2 > 5000' <<< "$s"
Output:
INFO Count [5987]
INFO Count [9865]
Count [number] part. With grep, you can use grep '\[[5-9][0-9]\{3,\}]' file.grep -E 'Count \[[1-4]?[0-9]{1,3}]' file / grep 'Count \[[1-4]\{0,1\}[0-9]\{1,3\}]' file, see regex101.com/r/gVh7tp/1
9865also as it is> 5000