Nsryjdtyk

I have a log file which logs cat and sub cat names that failed with message error. My goal is to find the most occurring categories.

e.g. log.:

Mon, 26 Nov 2018 07:51:07 +0100 | 164: [ERROR ***] Category ID not found for 'mcat-name1' 'subcat-name1' ref: '073' 

Mon, 26 Nov 2018 07:51:08 +0100 | 278: [ERROR ***] Category ID not found for 'mcat-name2' 'subcat-name2' ref: '020' 

Now I want to identify the top 10 categories that failed.

Using sed:

sed -e 's/s/n/g' < file.log | grep ERROR | sort | uniq -c | sort -nr  | head  -10

I am getting 1636 [ERROR

While I was looking for a list of categories sorting after amount of occurrenxe. e.g.

139 category1

23 category 2

...

You say you want to make a counting using sed, but actually, you are having an entire pipeline with sed, grep, sort, uniq and head. Generally, when this happens, your problem is screaming for awk:

awk 'BEGIN{FS="47"; PROCINFO["sorted_in"]="@val_num_asc"}

     /[ERROR /{c[$2]++}

     END{for(i in c) { print c[i],i; if(++j == 10) exit } }' file

The above solution is a GNU awk solution as it makes use of non-POSIX compliant features such as the sorting of the array traversal (PROCINFO). The field separator is set to the <single quote> (') which has octal value 47 as it assumes that the category name is between single quotes.

If you are not using GNU awk, you could use sort and head or do the sorting yourself. One way is:

awk 'BEGIN{FS="47"; n=10 }

     /[ERROR /{ c[$2]++ }

     END {

       for (l in c) {

         for (i=1;i<=n;++i) { 

           if (c[l] > c[s[i]]) {

             for(j=n;j>i;--j) s[j]=s[j-1];

             s[i]=l

             break

           }

         }

       }

       for (i=1;i<=n;++i) {

         if (s[i]=="") break

         print c[s[i]], s[i]

       }

     }' file

or just do:

awk 'BEGIN{FS="47"}

     /[ERROR /{c[$2]++}

     END{for(i in c) { print c[i],i; if(++j == 10) exit } }' file 

| sort -nr | head -10

You got 1636 [ERROR because you change the space character into a newline character, then you grep the word ERROR, then you count.

This :

sed -e 's/s/n/g' < file.log | grep ERROR 

Gives you this :

[ERROR

[ERROR

[ERROR

[ERROR

[ERROR

[ERROR

... (1630 more)

You need to grep first then sed (pretty sure you can do better with sed but I'm just talking about the logic behind the commands) :

grep ERROR file.log | sed -e 's/s/n/g' | sort | uniq -c | sort -nr | head -10

This may not be the best solution as it counts the word ERROR and other useless words, but you didn't give us a lot of information on the input file.

Assuming 'Bulgari' is an example of a category you want to extract, try

sed -n "s/.*ERROR.*] Category '([^']*)'.*/1/p" file.log |

sort | uniq -c | sort -rn | head -n 10

The sed command finds lines which match a fairly complex regular expression and captures part of the line, then replaces the match with the captured substring, and prints it (the -n option disables the default print action, so we only print the extracted lines). The rest is basically identical to what you already had.

In the regex, we look for (beginning of line followed by) anything (except a newline) followed by ERROR and later on followed by ] Category ' and then a string which doesn't contain a single quote, then the closing single quote followed by anything. The lots of "anything (except newline)" are required in order to replace the entire line with just the captured string from inside the single quotes. The backslashed parentheses are what capture an expression; google for "backref" for the full scoop.

Your original attempt would only extract the actual ERROR strings, because you replaced all the surrounding spaces with newlines (assuming vaguely that your sed accepts the Perl s shorthand, which isn't standard in sed, and that n gets interpreted as a literal newline in the replacement, which also isn't entirely standard or portable).

The way to go is to select the erred categories and replace the whole line with only the Category name using sed.

Give a try to this:

sed -e "s/^.* [ERROR .*] Category '([^']*)' .*$/1/g" file.log | sort  | uniq -c | sort -nr | head -16

^ is the start of the line

( ... ) : the char sequence enclosed in this escaped parenthesis can be referred with 1 for the first pair appearing in the regex, 2 for the second pair etc.

$ is the end of the line.

The sed selects a line which contains [ERROR and some chars until a ], folled with the word Category, and then after the (space) char, any sequence of chars, up to the next space char, is selected with a pair of escaped parenthesis, followed with any sequence of chars up to the end of the line. If a such a line is found, it is replaced with the char sequence after Category.

Using Perl

> cat merlin.txt

Mon, 26 Nov 2018 07:51:07 +0100 | 164: [ERROR ***] Category ID not found for 'mcat-name1' 'subcat-name1' ref: '073'

Mon, 26 Nov 2018 07:51:08 +0100 | 278: [ERROR ***] Category ID not found for 'mcat-name2' 'subcat-name2' ref: '020'

Mon, 26 Nov 2018 07:51:21 +0100 | 1232: [ERROR ***] Category ID not found for 'make' 'model' ref: '228239'

> perl -ne ' { s/(.*)Category.*for(.+)ref.*/2/g and s/(47S+47)/$kv{$1}++/ge if /ERROR/}  END { foreach (sort keys %kv) { print "$_ $kv{$_}n" } } ' merlin.txt | sort -nr

'subcat-name2' 1

'subcat-name1' 1

'model' 1

'mcat-name2' 1

'mcat-name1' 1

'make' 1

>