How can I decode multlines? I have this log:
Jan 31 02:05:03 1centavo maradns.conf: 2009-01-31 04:05:03 Log: Menssagem recebida, processando Jan 31 02:05:06 1centavo maradns.conf: 2009-01-31 04:05:03 Query from: 200.234.202.10 @mydomain.co.cc Jan 31 02:04:59 1centavo maradns.conf: 2009-01-31 04:04:59 Log: Menssagem recebida, processando Jan 31 02:04:59 1centavo maradns.conf: 2009-01-31 04:04:59 Query from: 208.76.253.253 N. Jan 31 02:04:59 1centavo maradns.conf: 2009-01-31 04:04:59 Log: Consulta incorreta recebida: \351\037\ Jan 31 02:04:59 1centavo maradns.conf: From IP: 208.76.253.253 The first one is a correct query, so I want to ignore it. The second block is what I want to log. So I want to use the string "Log: Consulta incorreta recebida:" to identify the bad query, but I want to extract the origin IP address that is on the above or below line. I don´t know how to.
