Thanks Jim. I'll try with AWK and will reply with results.

May be someone will ask why I'm not using logs directly from Asterisk. Well the pbx server is on different machine, and it's not possible to do so. At least for now. That's why I'm using zabbix mysql base.

@Jim - quotes like 1111 are for queues. Each queue have his own name, but sadly in logs I have only queue number, so I have to add name. In logs I have 1111, and I need to change it to 1111-name... like 1111-queue_support_team.. and so on.
I know it's not good the way I did it. I'm newbie with this things...., that's why I'm asking you guys...

---------- Post updated at 02:12 PM ---------- Previous update was at 08:58 AM ----------

Thanks to Jim for pointing me to right direction.. now I have this for exitwithtimeout:

1. mysql pull data

Code:

mysql -u select -D zabbix -e "select clock,value from history_log;" | grep -v -e endpoint -e ADDMEMBER -e REMOVEMEMBER -e '|02' |  grep EXITWITHTIMEOUT > "/tmp/exitwithtimeout.txt"

before text format:

Code:

1458314962      1458314937|1458314907.591|1111|NONE|EXITWITHTIMEOUT|1|1|30

first column is zabbix time, not needed. Second column is end time (why, don't ask, asterisk thing I think), third column is start time.

2. text format:

Code:

cat /tmp/exitwithtimeout.txt | awk -F '[ |]'  'BEGIN {OFS="|"} { print strftime("%c|", $2) strftime("%c|", $1) $3,$5,$8; }' | sed 's/|1111|/|1111-Support_team_queue|/g' > exitwithtimeout.log

final result:

Code:

Fri 18 Mar 2016 11:28:27 AM EDT|Fri 18 Mar 2016 11:29:22 AM EDT|1111-Support_team_queue|EXITWITHTIMEOUT|30

Good thing - first step is done. I have data and formatted text, and I will do that for other two log files.

Now I have to think how to include only waittime > 14000 into final result, and how to track particular
queue for exitwithtimout > 1 in any hour. WAITTIME and EXITWITHTIMEOUT are part from different files - WAITTIME is from RINGNOANSWER, and queues are in all three,
but I need only from EXITWITHTIMEOUT.

WAITTIME is last one in this output (raw, before text format):

Code:

1458220872 1458220872|1458220852.47158|1111|John Wright|RINGNOANSWER|20000

Queue in EXITWITHTIMEOUT is 4th in log file (raw output before text formatting):

Code:

1458314937  1458314937|1458314907.591|1111|NONE|EXITWITHTIMEOUT|1|1|30

---------- Post updated at 04:54 PM ---------- Previous update was at 02:12 PM ----------

Well.. the answer how to include only > 14000 maybe is :

Code:

awk -F '[|]' -v x=14000 '$6 > x' /tmp/ringnoanswer.txt

and included with things above:

Code:

cat /tmp/ringnoanswer.txt | awk -F '[|]'  'BEGIN {OFS="|" } {print strftime("%c|", $2) strftime("%c|", $1) $3,$4,$5,$6;'} | 
                    awk -F '[|]' -v x=14000 '$6 > x' | sed 's/|1111|/|1111-Support_team_queue|/g'  > ringnoanswer.log

Moderator's Comments:

Please use CODE tags (not ICODE tags) for full line and multi-line sample input, sample output, and code segments.