snippets/linux/log-analysis/web/group-by.md

Group by IP since 24h

docker logs reverse-proxy --since 24h 2>&1 \
| grep -e "fam\.s-up\.net" \
| grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" \
| sort \
| uniq -c

Resolve IPs

for ip in `
  docker logs reverse-proxy 2>&1 \
  | grep -e "fam\.s-up\.net" \
  | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" \
  | sort \
  | uniq`; do echo "$ip" `dig -x $ip +short`; done

Visites sites

docker logs reverse-proxy 2>&1 \
  | grep -e "fam\.s-up\.net" \
  | grep -oE '[a-z]*.php' \
  | sort \
  | uniq -c