When nginx access logs reach gigabyte scale, utilities like cat or tail become impractical for pinpointing traffic on a specific date. The sed stream editor processes text line-by-line using regular expressions, making it efficient for slicing large log files by timestamp ranges.
Log Timestamp Structure
A standard nginx access entry places the request time between the client identifier and the HTTP method:
example.com 5.53.125.207 - - [24/Feb/2016:12:48:41 +0800] "GET http://example.com/assets/icon.png HTTP/1.1" 200 1027
The date segment follows the pattern DD/Mon/YYYY:HH:MM:SS. Because the month is a three-letter abbreviation and the field is bracketed, literal characters and slashes must be escaped in basic regular expressions.
Date-Range Extraction
Use a address range to print every line from the first match to the second match:
sed -n '/16\/Feb\/2016/,/17\/Feb\/2016/p' access.log > 2016-02-16.log
The -n option suppresses automatic printing, while p explicitly outputs the matched range. Redirecting to a new file preserves the original log and avoids interfering with active file handles.
To narrow the window to a single hour, expand the pattern:
sed -n '/16\/Feb\/2016:14/,/16\/Feb\/2016:15/p' access.log > 2016-02-16_14h.log
Frequently Used Options
| Flag | Description |
|---|---|
-n |
Silent mode; display only lines selected by a command |
-e |
Add a script expression to the execution chain |
-r |
Enable extended regex syntax (fewer backslashes needed) |
-i |
Modify the source file in place (avoid on actively written logs) |
-f |
Execute commands stored in an external file |
Core sed Commands
Commands follow an optional address or address range:
p— Print lines (typically used with-n)d— Delete liness— Search and replace using regexa— Append text after the matched linei— Insert text before the matched linec— Change (replace) the matched lines with new text
Regex Quick Reference
Operators useful for log filtering:
^— Anchor to the beginning of a line$— Anchor to the end of a line.— Match any single character except a newline*— Match zero or more of the preceding element[abc]— Match any one character inside the brackets[^abc]— Match any one character not inside the brackets\( \)— Capture a group; reference later with\1,\2, etc.\&— Represent the entire matched text in a replacement string\<and\>— Match the start and end of a word\{m\}— Match exactly m consecutive occurrences\{m,\}— Match at least m consecutive occurrences\{m,n\}— Match between m and n consecutive occurrences
Working with In-Production Logs
Because sed operates as a stream processor, it never loads the full file into RAM. This behavior is critical when handling files that exceed available memory. Always write extracted ranges to a separate file rather than editing in place, since nginx holds an open file descriptor and sed -i can cause log rotation issues or data loss.