Regex Linux筛选器用于报告的大日志文件

我有一个26000多个文件的大日志，每个文件的内容如下。。我需要排除所有包含404和JSON的行。在下面的例子中，我需要得到最后一行，因为这是包含404而不是JSON的内容。写过滤正则表达式有什么帮助吗？感谢Linux专家的帮助

错误pbmzjYvLFIlLeth6mN2Yox9DH4vap1hcFHuJgNosd0XHVSxGdRcrWw==pdl.astro.com.my http 151 0.004----错误 2015-07-28 11:34:55 SIN3 659 14.192.213.22获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfo_211;.jpg 404

版本：1.0 字段：日期时间x-edge-location sc字节c-ip cs方法cs（主机）cs uri stem sc状态cs（引用者）cs（用户代理）cs uri查询cs（Cookie）x-edge-result-type x-edge-request-id x-Host-header cs协议cs字节所用时间x-forwarded-for ssl协议ssl密码x-edge-response-result-type 2015-07-28 11:34:57 MAD50 658 124.13.170.152获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfoÓ.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；SD）-错误TDLMNSFROelbe82y3kip\u QFBF7S3DDCN4RHR65JOMKOTZU4DZA==pdl.astro.com.my http 151 0.004----错误 2015-07-28 11:34:53 SIN3 659 14.192.214.93获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfoÓ.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；SD）-错误5r0xshnxly5tepej6zfkvhurhqnbd2lbwtdqoselj4z7tz5n68zha==pdl.astro.com.my http 151 0.002----错误 2015-07-28 11:34:53 SIN3 659 14.192.213.198获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfoÓ.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；SD）-错误koggtk2mcds3xvabs0zaeqheh52tonmjgiqah5a0tykizl6qsgrw==pdl.astro.com.my http 1510.001----Error 2015-07-28 11:34:54 SIN3 659 14.192.208.27获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfoÓ.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；SD）-错误bvlie540onmcez0qpomx1okoclgngvswpguomg85wnaxkj1rydg==pdl.astro.my http 151 0.002-错误 2015-07-28 11:34:54 SIN3 659 210.19.26.33获取d2v2sjgehuhalt.cloudfront.net/thumboil/mediaInfoÓ211.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；SD）-错误6wl5xeczarn3wgaigoa6xjuqzheenbwomchimzpayefduc8wra==pdl.astro.com.my http 151 0.001----Error 2015-07-28 11:34:54 SIN3 659 121.121.62.92获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfoÓ.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；SD）-错误WLN7Hebo3pvvvvw1vt365evxqod440by6qh6ryyazsypbzuwss0jg==pdl.astro.com.my http 151 0.001----错误 2015-07-28 11:34:54 SIN3 659 14.192.213.9获取d2v2sjgehuhalt.cloudfront.net/缩略图/mediaInfoÓ211.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；SD）-错误HTBK9HE5NYFSLA1DMEC1JHUMTOUY6E7QVYF0V1YYJ1GBP-I40bw==pdl.astro.com.my http 151 0.001----错误 2015-07-28 11:34:55 SIN3 659 14.192.213.250获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfoÓ.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；HD）-错误avwgyszygexdvxzhlfp5ulj4ie5hx8pa6zjc5ghxfvokyexp8o0g==pdl.astro.com.my http 151 0.001----错误 2015-07-28 11:34:55 SIN3 659 14.192.211.78获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfoÓ211.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；SD）-错误wbepjcn58o9aitfvctrkjdadg--zsltsjsjjdpubkxneu5tahxxq==pdl.astro.com.my http 151 0.004----错误 2015-07-28 11:34:55 SIN3 659 121.121.101.4获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfoÓ.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520（OSD:%252032%2520；SD）-错误YZ07B5VU7L4I3OTCBXF5RCH8DWRV5A7XRQQQQHydDNKWG==pdl.astro.com 2015-07-28 11:34:55 SIN3 659 14.192.208.156获取d2v2jgehuhalt.cloudfront.net/thumbnail/mediaInfoÓ.json 404-NDS%2520VM%2520Engine/002%2520Apr%252004%25202014%2520 2015-07-28 11:34:55 SIN3 659 14.192.213.22获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfo_211;.json 404

• 错误pbmzjYvLFIlLeth6mN2Yox9DH4vap1hcFHuJgNosd0XHVSxGdRcrWw==pdl.astro.com.my http 151 0.004----错误 2015-07-28 11:34:55 SIN3 659 14.192.213.22获取d2v2sjgehuhalt.cloudfront.net/thumbnail/mediaInfo_211;.jpg 404

请阅读，你的问题是原样的，而你没有；这不是关于编码的，可能更好

如果您想解析大型HTTP日志，您应该使用，如果您想要JSON输出，因为这个社区是关于编码的，您可以扩展它来实现这一点

否则，对于您最初的问题，这里有一种使用

awk

的方法：

awk '$NF == 404 && $(NF -1) ~ /\.json$/ { next; } {print}' /path/to/yourfile.log

$NF == 404  # the last field is 404
$(NF -1)    # the field before the last
~ /\.json$/ # ends with .json
{ next; }   # skip this line
{ print }   # print anything else