Thank you all for your reply, after convert into grep pattern file, the script is below, let me know if it's the appropriate one:
grep pattern file | while read line; do
ip=`echo $line | cut -d ' ' -f 8`
fqdn=`echo $line | cut -d ' ' -f 6`
grepcidr -v -f /root/collect/china_routes.txt <(echo $ip) >/dev/null
if [ $? == 0 ]; then
grep $fqdn fqdnfile || echo $fqdn >> /root/collect/fqdn
fi
done
The above is trying see if 'pattern' show up in any line of file, then it pick-up the eighth field as ip, sixth field as fqdn(since the line is separated by space); then it will check whether $ip is in the cidr scope by grepcidr, if it's not within the scope(-v), then to check whether the $fqdn already exist in fqdnfile file, if it's not in the file, then echo the $fqdn into that file
The file itself looks like below:
Oct 11 20:19:05 dnsmasq[30593]: reply api.weibo.com is 180.149.135.176
Oct 11 20:19:05 dnsmasq[30593]: reply api.weibo.com is 180.149.135.230
Oct 11 20:19:06 dnsmasq[30593]: query[A] sina.com from 180.169.158.178
Oct 11 20:19:06 dnsmasq[30593]: forwarded sina.com to 114.114.114.114
Oct 11 20:19:06 dnsmasq[30593]: reply sina.com is 66.102.251.33
Oct 11 20:19:06 dnsmasq[30593]: query[PTR] 74.103.225.116.in-addr.arpa from 127.0.0.1
Oct 11 20:19:06 dnsmasq[30593]: cached 116.225.103.74 is NXDOMAIN-IPv4