Alias for recent log files

Question

Usually when I'm searching the logs, its for something that happened recently. I end up tabbing at bash prompt to complete the names.

I finally did bash alias that uses date arithmetic to build the file name. Something like following

grep <test> `date '+localhost_access_log.%C%y-%2m-%2d.txt' -d "-3 days"` grep 400 `date '+localhost_access_log.%C%y-%2m-%2d.txt' -d "-2 days"` grep 400 `date '+localhost_access_log.%C%y-%2m-%2d.txt' -d "-1 days"` grep 400 `date '+localhost_access_log.%C%y-%2m-%2d.txt' -d "-0 days"`

Is there anyway to optimize this? Ideally I would like to create multiple aliases to grep through most recent three files like localhost_access_log.2019-06-24.txt or api-2019-06-24-1.log and don't like date command code duplication. Essentially looking for help for a bash function that will return 4 most recent file names based on the pattern I send including today's log file and can be passed to grep command

Answer 1

If you don't insist on bash, you can do this quite easily in zsh using setopt extendedglob:

grep <test> *(ND.om[1,4])

will grep through the four most recent files in the current directory.

Explanation:

• N - turn on "null glob" (silently substitute nothing if the glob pattern doesn't match)
• D - turn on "GLOB_DOTS" (also match "hidden files")
• . - match plain files
• om - order by modification time
• [1-4] - array subscript

A pure bash solution could be something like

grep test $(ls -1rt | tail -n 4)

(But this will fail on funky filenames, such as ones with embedded spaces.)

find . -maxdepth 1 -type f -name "pattern" -mtime -1 -exec grep test {} +

Will grep through files in the current directory whose name matches pattern and which have been modified within the last day (this could be more than four, but it could also be zero). It'll work on funky filenames, though.

Answer 2

Here is a simple bash-based solution. It works by using ls to list the N most recent files matching a given wildcard, on the assumption that each log file is for a single day:

$ grep test $(ls -tr localhost_access_log.*.txt | tail -4)

If that counts as an unwise case of parsing the output of ls, then use this instead:

$ grep test $(find . -name localhost_access_log.\*.txt -mtime -3d)

In general, the point is to avoid getting tangled up in the date arithmetic. Just run grep on the N most recent files. Again, this assumes that your logs rotate once per day, as your question suggests.