How to grep 2 or 3 lines, one containing the text I want, and the others just below it?

Question

This is a snapshot of error log:

06:16:29,933 ERROR EmailRMManager$:45 - Exception In get Message
com.rabbitmq.client.AlreadyClosedException: clean connection shutdown; reason: Attempt to use closed channel
    at com.rabbitmq.client.impl.AMQChannel.ensureIsOpen(AMQChannel.java:195)
    at com.rabbitmq.client.impl.AMQChannel.rpc(AMQChannel.java:222)
    at com.rabbitmq.client.impl.AMQChannel.rpc(AMQChannel.java:208)
    at com.rabbitmq.client.impl.AMQChannel.exnWrappingRpc(AMQChannel.java:139)
    at com.rabbitmq.client.impl.ChannelN.basicGet(ChannelN.java:645)

I do the following command:

cat foo.log | grep ERROR to get an OP as:

06:16:29,933 ERROR EmailRMManager$:45 - Exception In get Message

What command should I execute to get the output as

06:16:29,933 ERROR EmailRMManager$:45 - Exception In get Message
    com.rabbitmq.client.AlreadyClosedException: clean connection shutdown; reason: Attempt to use closed channel

ie, also grep the line(s) after the pattern?

Is `com.rabbitmq.client` text on next line starts from the begginning or have some spaces in front of it? — Eugen Konkov, Nov 11 '16 at 09:09

score 90 · Accepted Answer · edited Nov 02 '16 at 01:17

90

Just do a:

grep -A1 ERROR

The -A1 tells grep to include 1 line after the match. -B includes lines before the match, in case you need that too.

edited Nov 02 '16 at 01:17

muru

193,181
53
473
722

answered Feb 24 '11 at 06:26

Jeremy Kerr

26,769
4
48
62

oh right, that would be helpful too. – theTuxRacer Feb 24 '11 at 06:34
13

And `-C` includes lines both before and after the match (the 'C' stands for 'context', I believe). – Marius Gedminas Feb 24 '11 at 16:01
I always get this mixed up because I instinctively think these stand for "above" and "below". – abeboparebop Jun 29 '21 at 11:36

score 7 · Answer 2 · answered Feb 24 '11 at 08:46

7

For a more portable way, there's awk

awk '/ERROR/{n=NR+1} n>=NR' foo.log

Or maybe you want all the indented lines following?

awk '/^[^[:blank:]]/{p=0} /ERROR/{p=1} p' foo.log

answered Feb 24 '11 at 08:46

geirha

45,233
13
70
67

2

:O that is good information, but rather overkill! nonetheless, its good to know a different method :) – theTuxRacer Feb 25 '11 at 04:55
I wish I understood how those `awk` commands work. – Firefeather Mar 04 '11 at 20:49
3

@Firefeather http://awk.freeshell.org/ is a good resource for learning awk. The GNU awk manual page is pretty good too. – geirha Mar 05 '11 at 12:28

score 2 · Answer 3 · answered Oct 13 '20 at 11:43

For this simple task a simple way is:

grep -A num
Print num lines of trailing context after each match. See also the -B and -C options.

grep -B num
Print num lines of leading context before each match. See also the -A and -C options.

grep -C num
Print num lines of leading and trailing context surrounding each match.
The default is 2 and is equivalent to -A 2 -B 2.

Note: no whitespace may be given between the option and its argument.

score 2 · Answer 4 · answered Nov 11 '16 at 09:07

I have found this solution:

cat apache.error.log | grep -Pzo '^.*?Exception In get Message.*?\ncom\.rabbitmq.*?(\n(?=\s).*?)*$'

Where (\n(?=\s).*?)* means:

\n find next line
(?=\s) where is starts from whitespace character
.*? until end of line
(...)* Find such lines multiple times

PS. You may turf this pattern \ncom\.rabbitmq.*? if second line begins from whitespace \s

How to grep 2 or 3 lines, one containing the text I want, and the others just below it?

4 Answers4

Linked

Related