Q:

Ruby on Rails log unauthorized requests only parsing

I need to parse my production rails app log file. And I need to extract only unauthorized requests.
Those parts starts with Started POST "/...some_url..." and ends with Completed 401 Unauthorized in {some_number}ms
I was successfull with exracting endings with cat mylog.log | grep -B 5 "Completed 401 Unauthorized", but this command captures only 5 strings before context. This context may vary  in really big range.
So, how to capture starting string also and to grab entire Completed 401 Unauthorized context` ?
UPD: Log file example:
Started POST "/api/orders" for 111.222.333.444 at 2014-02-12 07:37:23 +0400
Processing by Api::V2::OrdersController#create as JSON
  Parameters: {bla
  bla
  bla}
WARNING: Can't verify CSRF token authenticity
  Partner Load (0.9ms)  SELECT `partners`.* FROM `partners` WHERE `partners`.`agent_referer` = 'abcde' LIMIT 1
Completed 401 Unauthorized in 4ms

...

Started GET "/search/flights?depart_city=SVX&destin_city=AER&depart_date=17.02.2014&return_date=21.02.2014" for 111.222.333.444 at 2014-02-12 06:29:19 +0400
Processing by Api::V1::TripsController#index as JSON
  Parameters: {bla bla bla}
  Partner Load (0.1ms)  SELECT `partners`.* FROM `partners` WHERE `partners`.`agent_referer` = 'xxx' LIMIT 1
  Partner Load (0.1ms)  SELECT `partners`.* FROM `partners` WHERE `partners`.`name` = 'xxx' LIMIT 1
  Partner Load (0.0ms)  SELECT `partners`.* FROM `partners` WHERE `partners`.`agent_referer` = 'xxx'
   (0.0ms)  SELECT COUNT(*) FROM `partner_statuses` WHERE `partner_statuses`.`partner_id` = 26 AND (active_to >= '2014-02-11 19:59:59')
  PartnerStatus Load (0.0ms) SQL REQUEST HERE
  Rendered api/v1/trips/index.xml.builder (0.6ms)
Completed 200 OK in 39ms (Views: 1.3ms | ActiveRecord: 25.7ms)

A:

Using a little state machine in awk:
awk '
    $1 == "Started"   { capture = 1 } 
    capture           { lines[n++] = $0 } 
    $1 == "Completed" {
        capture=0
        if ($3 == "Unauthorized") 
            for (i=0; i<n; i++) 
                print lines[i]
        n=0
        delete lines
    }
' log.log

