Shell Programming and Scripting

Dear unix forum members,
I'm working on a script that will parse a mail machine's logs and print a list of email addresses in this format:
authen@domain.com | sender@domain | recipient@domain
exam
account1@domain1.com | sender2@domain2.com | brian5841@yahoo.com,brooke_leee@yaho...0809@yahoo.com
or
account1@domain1.com | sender2@domain2.com | brian5841@yahoo.com
account1@domain1.com | sender2@domain2.com | brooke_leee@yahoo.com
account1@domain1.com | sender2@domain2.com | c0809@yahoo.com
The logs look something like this:
Feb 18 20:00:11 mail postfix/smtpd[27053]: F33E01715C9: client=unknown[22.22.22.22], sasl_method=LOGIN, sasl_username=account1@domain1.com
Feb 18 20:00:14 mail postfix/cleanup[27072]: F33E01715C9: message-id=<JGWU@domain2.com>
Feb 18 20:00:14 mail postfix/qmgr[27047]: F33E01715C9: from=<sender2@domain2.com>, size=5578, nrcpt=30 (queue active)
Feb 18 20:00:20 mail postfix/smtp[27117]: F33E01715C9: to=<brian5841@yahoo.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=8.5, delays=2.6/0.01/0.01/5.9, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=13740-01, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 5AEE71715D0)
Feb 18 20:00:20 mail postfix/smtp[27117]: F33E01715C9: to=<brooke_leee@yahoo.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=8.5, delays=2.6/0.01/0.01/5.9, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=13740-01, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 5AEE71715D0)
Feb 18 20:00:20 mail postfix/smtp[27117]: F33E01715C9: to=<c0809@yahoo.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=8.5, delays=2.6/0.01/0.01/5.9, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=13740-01, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 5AEE71715D0)
Feb 18 20:00:21 mail postfix/qmgr[27047]: F33E01715C9: removed

The "from" and "to" are on different lines and there is another challenge which is that the results should be limited to messages who have 3 or fewer recipients.
I thought it would be easy enough, and I wrote a script that first gets a list of the tag numbers ( F33E01715C9 which belong to messages with 3 or fewer recipients

Needless to say, its not an efficient script, there must be a better way. Please help!! Any responses are appreciated, maybe someone can just point me in the right direction?

Thanks,
Puka

---------- Post updated at 09:52 PM ---------- Previous update was at 01:03 PM ----------

Dear Member,

I want out put.

authen@domain.com | sender@domain | recipient@domain

exam

account1@domain1.com | sender2@domain2.com | brian5841@yahoo.com,brooke_leee@yaho...0809@yahoo.com

or

account1@domain1.com | sender2@domain2.com | brian5841@yahoo.com
account1@domain1.com | sender2@domain2.com | brooke_leee@yahoo.com
account1@domain1.com | sender2@domain2.com | c0809@yahoo.com


Please help to write full script for me by perl or shell.
Regards
Puka

Not good solution, but simple.

Code:

 egrep -o "sasl_username=.*|from=.*|to=.*" infile  |awk '/sasl_username=/{username=$1;i=0}
/from=/{from=$1}
/to=/&&++i<=3{print username, from, $1}' OFS="|" |awk '{gsub(/sasl_username=|from=|to=|<|>|,/,"")}1'


account1@domain1.com|sender2@domain2.com|brian5841@yahoo.com
account1@domain1.com|sender2@domain2.com|brooke_leee@yahoo.com
account1@domain1.com|sender2@domain2.com|c0809@yahoo.com
account1@domain1.com|sender2@domain2.com|brian5841@yahoo.com
account1@domain1.com|sender2@domain2.com|brooke_leee@yahoo.com
account1@domain1.com|sender2@domain2.com|c0809@yahoo.com

I generate code but not want out put.

sasl_username=account1@domain1.com
from=<account1@domain1.com>,
from=<account1@domain1.com>,
to=<account1@domain1.com>,
from="avel88@hotmail.com";
from=avel88@hotmail.com,
from=avel88@hotmail.com,
from=<avel88@hotmail.com>,
to=<account2@domain2.com>,
from=<seo1@co.za>
from=<avel88@hotmail.com>,
to=<iam@hotmail.co.th>,
to=<da@hotmail.com>,
to=<account3@domain3.com>,
to=<user1@domain3.com>,
to=<user2@domain3.com>,
to=<user3@domain3.com>,
to=<user4@domain3.com>,

my code

awk ' BEGIN { FS="[" } /client=/ { print $3 } ' < /var/log/mail.log | sed s/]//

22.13.23.200, sasl_method=LOGIN, sasl_username=account1@domain1.com, ........... , .............
33.14.55.243
55.154.173.75
66.15.219.1, sasl_method=LOGIN, sasl_username=account1@domain2.com, ........... , .............
14.12.138.57, sasl_method=LOGIN, sasl_username=account1@domain3.com, ........... , .............

I can not show , ....from=<....... , .....to=<........ , .....to=<........ , .....to=<........ (to 3 account)

or

, ....from=<....... , .....to=<........ (to 1 account)

---------- Post updated at 10:42 PM ---------- Previous update was at 10:37 PM ----------

if out put

account1@domain1.com | sender2@domain2.com | brian5841@yahoo.com,brooke_leee@yaho...0809@yahoo.com

I wrtie code ?

Thank you very much

Seems from= has multi-instances. My current code doesn't work in this situation.

But continue your question for the new output only:

Code:

egrep -o "sasl_username=.*|from=.*|to=.*" infile  |awk '/sasl_username=/{print username,from,to[username FS from];username=$1;i=0}
/from=/{from=$1}
/to=/&&++i<=3{to[username FS from]=to[username FS from] OFS $1}' OFS="|" |awk '{gsub(/sasl_username=|from=|to=|<|>|,/,"")}1'