Colorize log files

Question

This is a follow-up on How to optimize script for colorizing log files.

Here a my specifications:

• Line format is: [Level][Date and time][Module] - [Interesting part]
• Color Level, Date and time, and Module in BLACK for all lines
• Depending on Level:
  • ERROR - Color Interesting part in white on red
• Depending on Module:
  • DataSourceImpl - Use default color for Interesting part
  • DbConnectionImpl - Color Interesting part in white
  • Handler - Color Interesting part in magenta

That works very well with:

BEGIN {
    magenta = "\x1b[35m"; white = "\x1b[37m"; BLACK = "\x1b[30;1m"; onred = "\x1b[41m";
    reset  = "\x1b[0m"

    color["DataSourceImpl"] = reset
    color["DbConnectionImpl"] = white
    color["Handler"] = magenta
}

match($0, /\[(.*)\]\[(.*)\]\[(.*)\] - \[(.*)\]/, a) {
    if (a[1] == "ERROR" || a[1] == "WARN ")
    {
        print BLACK "[" a[1] "][" a[2] "][" a[3] "] - [" reset white onred a[4] reset BLACK "]" reset
        next
    }
    else if (a[3] == "DataSourceImpl" || a[3] == "DbConnectionImpl" || a[3] == "Handler")
        $0 = BLACK "[" a[1] "][" a[2] "][" a[3] "] - [" reset color[a[3]] a[4] reset BLACK "]" reset
    else
        $0 = BLACK "[" a[1] "][" a[2] "][" a[3] "] - [" a[4] "]" reset
}

// {print $0}

On a 45 MB log file:

• cat server.log | colorlog takes 15.277 seconds
• cat server.log takes 14.007

so, it even is fast enough! Almost no visible difference...

Now, extra specifications:

• Highlight SQL constructs

  • SELECT .. FROM .. WHERE in yellow
  • INSERT INTO .. in green
  • DELETE FROM .. in red where table names should be higlighted in "bold" colors.

  NOTE -- SELECT keywords used in INSERT TO constructs (instead of VALUES) can be highlighted in yellow as well. No exception.

• Highlight strings (between quotes) in cyan.

Updated script:

BEGIN {
    magenta = "\x1b[35m"; white = "\x1b[37m"; BLACK = "\x1b[30;1m"; onred = "\x1b[41m";
    yellow="\x1b[33m"; YELLOW="\x1b[33;1m"; cyan="\x1b[36m"
    reset  = "\x1b[0m"

    color["DataSourceImpl"] = reset
    color["DbConnectionImpl"] = white
    color["Handler"] = magenta
}

match($0, /\[(.*)\]\[(.*)\]\[(.*)\] - \[(.*)\]/, a) {
    if (a[1] == "ERROR" || a[1] == "WARN ")
    {
        print BLACK "[" a[1] "][" a[2] "][" a[3] "] - [" reset white onred a[4] reset BLACK "]" reset
        next
    }
    else if (a[3] == "DataSourceImpl" || a[3] == "DbConnectionImpl" || a[3] == "Handler")
        $0 = BLACK "[" a[1] "][" a[2] "][" a[3] "] - [" reset color[a[3]] a[4] reset BLACK "]" reset
    else
        $0 = BLACK "[" a[1] "][" a[2] "][" a[3] "] - [" a[4] "]" reset
}

match($0, /(.*)(SELECT|select)(.*)((FROM|from) ([^ )]*))([^\]]*)(WHERE|where)(.*)/, a) {
    $0 = a[1] yellow a[2] reset a[3] yellow a[5] reset " " YELLOW a[6] reset yellow a[7] yellow a[8] reset a[9]
}

// { gsub(/'[^']*'/, cyan "&" reset); }

// {print $0}

This incomplete script already leads to the following problems:

1. Only one SELECT .. FROM .. WHERE construct is higlighted per line -- and I don't see how to avoid this (unlike what I did for highlighting the strings between quotes.
2. Execution time explodes: 4 minutes 44 seconds!!!
3. Colors are not surimposed on my initial choices: after SELECT, the colum names are colored with the default foreground color, not anymore in white (when module was DbConnectionImpl). That's because of the "reset" color; but I don't see how to do to add color, but preserving what I had before.

Any tip on what direction to take to solve these problems?