<p>I need to list the error pods below 5 days with all the columns. I have tried the below command, but no luck. I am getting some random pods and age. Could someone help to get only error pods which are below 5 days.</p>
<pre><code>kubectl get pod --all-namespaces --sort-by=.metadata.creationTimestamp | awk 'match($5,/[1-5]+d/) {print $0}' | grep &quot;Error&quot;


NAME               READY   STATUS      RESTARTS   AGE
pod1                0/1     Error       0          63d
pod2                0/1     Error       0          24d
pod3                0/1     Error       0          11d
pod4                0/1     Error       0          4d16h
pod5                0/1     Error       0          15h
</code></pre>

<p>Answering your question I would like to point out <strong>4 different things</strong>.</p>
<p><strong>First</strong>, the use of the regular expression in your example is not correct. The following regular expression:</p>
<pre><code>[1-5]+d
</code></pre>
<p>will match not only <code>1d</code>,<code>2d</code>,<code>3d</code>,<code>4d</code> and <code>5d</code> as you intended but it will also match <code>63d</code> or <code>24d</code>. Why ? Firstly, because you used <code>+</code> <a href="https://www.regular-expressions.info/refrepeat.html" rel="nofollow noreferrer">quantifier</a> which <em>repeats the previous item once or more.</em> so it will match even <code>345d</code> if you have such <code>Pods</code> running in your k8s cluster. Secondly, you didn't specify that it should start from a number between 1 and 5, it only says that it should occur somewhere (e.g. in the end) in the matched string, so <code>[1-5]d</code> will also match <code>63d</code> because it will be able to find <code>3d</code> in it. The correct form of this regular expression looks like this:</p>
<pre><code>^[1-5]d
</code></pre>
<p>Here we specify that it should match only strings which start with exactly one digit in range from 1 to 5 followed by <code>d</code> character.</p>
<p>So <code>awk</code> part of your command may look as follows:</p>
<pre><code>awk 'match($5,/^[1-5]d/) {print $0}'
</code></pre>
<p><strong>Second</strong>, note that when you run:</p>
<p><code>kubectl get pod</code> with <code>--all-namespaces</code> flag, the output contains 6 columns, not 5, as already mentioned in comments by <a href="https://stackoverflow.com/users/5147259/krishna-chaurasia">Krishna Chaurasia</a>. Additional column with <code>NAMESPACE</code> header is added. Compare 2 following results:</p>
<pre><code>$ kubectl get pods
NAME                                READY   STATUS             RESTARTS   AGE
my-release-mysql-0                  1/1     Running            0          12d
</code></pre>
<p>and</p>
<pre><code>$ kubectl get pods --all-namespaces
NAMESPACE     NAME                                                       READY   STATUS             RESTARTS   AGE
default       my-release-mysql-0                                         1/1     Running            0          12d
</code></pre>
<p><code>AGE</code> becomes 6th column so your command (or specifically its <code>awk</code> part) should rather perform the match on column <code>$6</code>:</p>
<pre><code>awk 'match($6,/^[1-5]d/) {print $0}'
</code></pre>
<p><strong>Third</strong>, as to the last part of your command i.e.:</p>
<pre><code>grep &quot;Error&quot;
</code></pre>
<p>such filtering can be done by <code>kubectl</code> based on <code>--field-selector</code> e.g.:</p>
<pre><code>kubectl get pods --field-selector=status.phase=Pending --sort-by=.metadata.creationTimestamp | awk 'match($5,/^[1-5]d/) {print $0}'
</code></pre>
<p><strong>Fourth</strong>, it should be noted that in your example you're filtering out all the <code>Pods</code> which <code>AGE</code> is counted in other units like <code>hours</code>, <code>minutes</code> or <code>seconds</code>. If it's intended, just ignore the next paragraph.</p>
<p>However if you don't want to filter out all newer <code>Pods</code>, where <code>AGE</code> cannot be counted in <code>days</code>, you may modify your command so it shows <code>Pods</code> that were created <code>1-5 days</code> or <code>any number of seconds/minutes/hours</code> ago:</p>
<pre><code>kubectl get pods --sort-by=.metadata.creationTimestamp | awk 'match($5,/^[1-5]d|[1-9]+h|[1-9]+m|[1-9]+s/) {print $0}'
</code></pre>
