$ tac /var/log/rsync.log | perl -lane 'if(/received/){ print "$F[0] $F[1]"; exit }' # Update 2017-04-21: compacting that a little bit: $ tac /var/log/rsync.log | perl -lane 'if(/received/){print"@F[0,1]";exit}'