I have a log file that I am attempting to pull a string out of. The numerical string is randomly generated and so far all of my attempts to use grep/sed/awk have been unsuccessful.

I have an entry like the following:


What I am trying to parse is the randomly generated portion of


Anyone have a quick and dirty method to get this to work?

  • 1
    This looks like it's from a longer JSON document. Could you share a bit more of the document's structure? It would be easy to pull it out with a JSON parser. – Kusalananda May 21 at 14:17

Quick and dirty like this?

$ grep -o -P '(?<=")[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}(?=")' input

Looks for any random "30c962de-b448-40ac-ade8-da6a8f49ce88" values with fixed length and dash - positions, enclosed in quotation marks, and prints it out. If you want to insist on the "id": part too, just add it to the leading quote condition (?<=").

However if that's JSON or anything sane you should consider using an appropriate parser for that kind of data (like jq or whatever).

  • Or you could have it use the whole length between the quotes, but make it non greedy. – stackzebra May 21 at 14:33
  • That works like a charm thanks!! It came from JSON but it is being logged to a log file and is being used elsewhere. – Kevin May 21 at 15:03

Another dirty trick using AWK on provided input.

echo $data  | awk -F , '{ print $1}' | awk -F id:  '{print $1}' | awk  '{print $1}'

If this is actually a JSON document, then using jq would pull the string out regardless of the formatting of the data:

jq -r '.document[2].part.id' file.json

This assumes that the id key is part of a part object, which is in turn part of a particular element in a document array at the top level of the JSON data structure.

Or, you could just extract all id values:

jq -r '.. | select(type=="object" and has("id")) | .id' file.json
  • I have not used jq so how would I use it to pull more than one value? Would I simply add multiple AND statements i.e. and has ("id" AND "status") or something similar?? – Kevin May 22 at 12:11
  • @Kevin As I wrote in my comment to the question, we don't know what your document's structure looks like. A query in with jq (or any other JSON parser) relies on pulling out or examining specific keys/values in the document, at specific places. The way the query is written is highly dependent on the structure of the JSON document. – Kusalananda May 22 at 12:36

Tried with below mentioned sed command and it worked fine too

command: sed 's/.*:"//1' filename|sed 's/".*//g'




using awk:

awk -F"[\":]" '{ print $5 }' infile

Your Answer

