Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The original file format:

Nov 12 19:56:52 libra kernel: [ 1353.27355] WarningIN=em0 OUT=eth0 MAC=c8:1b:3c:fd:5D:e9:90:a9:8F:43:83:E3:15:0e SRC=222.171.89.16 DST=49.137.111.136 LEN=222 TOS=0x8C PREC=0xbF TTL=107 ID=31469 PROTO=ICMP TYPE=35 CODE=8 ID=24917 SEQ=166
Aug 00 08:35:51 virgo kernel: [ 4584.5613] That's oddIN=em0 OUT=eth0 MAC=0a:09:AA:4F:6C:41:c6:De:D6:6f:83:41:8e:dC SRC=142.53.155.238 DST=252.1.134.24 LEN=506 TOS=0x11 PREC=0x5c TTL=67 ID=5098 PROTO=ICMP TYPE=35 CODE=5 ID=31329 SEQ=22
Jun 21 11:47:48 taurus kernel: [ 741.5237] Look into this IN=em1 OUT=eth0 MAC=Bd:5b:ab:b7:47:fA:df:53:0E:E8:A7:2a:f6:c6 SRC=50.219.1.59 DST=56.95.45.60 LEN=390 TOS=0xf2 PREC=0x79 TTL=122 ID=28867 PROTO=UDP SPT=16351 DPT=15354 LEN=9

After:

19:56:52 12 Nov;Warning;em0;eth0;222.171.89.16;49.137.111.136;ICMP;;
08:35:51 00 Aug;That's odd;em0;eth0;142.53.155.238;252.1.134.24;ICMP;;
11:47:48 21 Jun;Look into this ;em1;eth0;50.219.1.59;56.95.45.60;UDP;16351;15354
share|improve this question
    
I tried to fix your formatting, please double check that appears as it should. –  nerdwaller Jul 30 '13 at 22:40
2  
1  
is it alright to use awk in the answer? –  Alexej Magura Jul 31 '13 at 0:18
    
@Hero, if one of the below answers is acceptable, please accept it! –  Alexej Magura Mar 30 at 14:30

3 Answers 3

Here you go

awk '{ if (NF > 0) 

    {printf $3 " " $2 " " $1 ";"} 

    {for (idex=8; idex <= NF; idex++) 

    { printf $idex " " } {print}}}' <FILE> \
        \
| sed -r 's/IN=/;/ ; s/\sOUT=/;/ ; s/ MAC.*\sSRC=/;/ ; s/ DST=/;/ ; s/ LEN.*PROTO=/;/ ; s/ SPT=/;/ ; s/ DPT=/;/ ; s/(LEN=[0-9]*|TYPE=[0-9]*|CODE=[0-9]*|ID=[0-9]*|SEQ=[0-9]*)//g ; s/\s*$/;;/ ; s/^;;$//'

Be sure to replace <FILE> with the name of the file you want to process.

Hope it works--it worked fine for me.

share|improve this answer
sed -r 's/([^ ]+) ([^ ]+) ([^ ]+) [^]]+\] (.+)IN=([^ ]+) OUT=([^ ]+)* .*SRC=([^ ]+) DST=([^ ]+) .*PROTO=(.*)/\3 \2 \1;\4;\5;\6;\7;\8;\9;/' file|sed -r 's/(([^;]*;){6})([^ ]+) (SPT=)*([0-9]+ )*(DPT=)*([0-9]+)*.*/\1\3;\5;\7/'
share|improve this answer
3  
Care to expand on this? –  Raystafarian Jul 31 '13 at 19:03

You can do this with sed, for example as suggested by @Hero. A better question is whether you should. sed is great, it is very powerful but it is not always the best tool for the job. I find it much easier to do this kind of thing with Perl:

perl -ne 's/(...)\s*(\d+)\s*([\d:]+).+?\]\s*.*?IN=(.+?)\s.*OUT=(.+?)\s.*SRC=([\d\.]+).*DST=([\d\.]+)/$3 $2 $1;$4;$5;$6;$7;$8/;print' foo.txt
share|improve this answer
    
-1 for using perl. Perl is not sed, and it should never be used as a replacement for sed. If you were doing something other than strictly substituting text, then maybe I could understand why you'd want to use perl, so that you could utilize flow control and crap, if you're just making perl act like sed, then do not use perl. –  Alexej Magura Mar 30 at 14:28
    
@AlexejMagura I will use the best tool for the job. In this case, that can indeed be perl. Should I downvote your answer because it is using awk and not pure sed? Also, offering alternative answers if someone has already provided what the OP was asking (a sed solution) is encouraged. –  terdon Mar 30 at 18:03
    
fair enough: you make a very valid point. –  Alexej Magura Mar 31 at 0:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.