Conditionals

if/else — categorize by field value

cat <<'EOF' > /tmp/metrics.txt
vault-01    connections  142   active
ise-01      connections  87    active
bind-01     queries      2031  active
pfsense     sessions     56    active
haproxy     connections  310   active
EOF
awk '{if($3 > 100) print "HIGH:", $0; else print "LOW:", $0}' /tmp/metrics.txt

Ternary operator for inline decisions

cat <<'EOF' > /tmp/metrics.txt
vault-01    connections  142   active
ise-01      connections  87    active
bind-01     queries      2031  active
pfsense     sessions     56    active
haproxy     connections  310   active
EOF
awk '{status = ($3 > 100) ? "HIGH" : "LOW"; print status, $0}' /tmp/metrics.txt

Multi-branch if/else if/else

cat <<'EOF' > /tmp/syslog-demo.txt
ERROR vault-01 auth: token expired for user admin
WARN  pfsense dns: upstream timeout 10.50.1.1
INFO  bind-01 named: zone transfer complete
ERROR ise-01 radius: EAP-TLS handshake failed
INFO  vault-01 audit: policy lookup succeeded
EOF
awk '{
    if($1 == "ERROR") print "ERROR:", $0
    else if($1 == "WARN") print "WARNING:", $0
    else print "INFO:", $0
}' /tmp/syslog-demo.txt

next — skip current line and move to next record

cat <<'EOF' > /tmp/config-raw.txt
# skip this comment
bind-ip=10.50.1.40
# skip this too
port=53
listen-on=any
# another comment
forwarders=1.1.1.1
EOF
awk '/skip/{next} {print}' /tmp/config-raw.txt

exit — stop processing at first match

cat <<'EOF' > /tmp/deploy-log.txt
[2026-04-11 08:00] Starting deployment vault-02
[2026-04-11 08:01] Pre-flight checks passed
[2026-04-11 08:02] Pulling container images
STOP -- fatal error: registry unreachable
[2026-04-11 08:03] This line should not appear
[2026-04-11 08:04] Nor this one
EOF
awk '/STOP/{exit} {print}' /tmp/deploy-log.txt

exit with status code — non-zero if too many lines

printf '%s\n' "line 1" "line 2" "line 3" | awk 'END{exit (NR > 100) ? 1 : 0}'
echo "Exit status: $?"

for loop — iterate over all fields in a record

echo "vault-01 10.50.1.30 8200 active sealed=false" | awk '{for(i=1; i<=NF; i++) print i, $i}'

while loop — field iteration

echo "ERROR auth token_expired vault-01 admin" | awk '{i=1; while(i<=NF) {print $i; i++}}'

Categorize journalctl log levels

journalctl --since "1 hour ago" --no-pager | awk '{
    level = "INFO"
    if(/ERROR|FATAL|CRIT/) level = "CRITICAL"
    else if(/WARN|WARNING/) level = "WARNING"
    else if(/DEBUG/) level = "DEBUG"
    print level, $0
}' | head -20