I have log files coming in that is not space delimited, really looks like they are not delimited at all. I need to collect the date and time the log entry was created which occurs after the words datetime":". (19 characters in length with no spaces)
datetime":" shows up with a standard date format YYYY-MM-DDT##:##:##.##
However it shows up multiple times and I only need to return the last occurence (to collect the most recent).
What I am getting:
Lots, and lots, of text, and junk for now followed by datetime":"YYYY-MM-DDT##:##:##.## then lots more log text here.
What I’d like to pull out is the LAST occurrence of YYYY-MM-DDT##:##:##.##
I tried using grep however it is returning the entire log entry since there is no delineation.
I tried grep -Eo ‘{{:digit:]]{4}-{{:digit:]]{2}-{{:digit:]]{2}’ but that just looks for dates and there is occasionally another date in the file.
Suggestions on how better to handle this. AWK and SED seem to be able to pick up but but not sure how to return only the 19 characters after datetime":"
>Solution :
This might be what you’re looking for:
grep -Eo '[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\.[0-9]{2}' file | tail -n1