grep & regular expressions

grep searches text for lines matching a pattern. It's one of the most-used commands on any Linux machine: digging through logs, finding where a function is defined, checking a config setting, filtering the output of other commands. Paired with regular expressions, it becomes a precision tool.

Sample log (app.log) used throughout:

2026-10-01 09:00:01 INFO  Server started on port 8080
2026-10-01 09:05:12 WARN  Disk usage at 85%
2026-10-01 09:07:45 ERROR Database connection refused
2026-10-01 09:08:00 INFO  Retrying database connection
2026-10-01 09:08:02 error payment-service timeout after 30s
2026-10-01 09:10:30 INFO  User asha@example.com logged in
2026-10-01 09:12:01 ERROR Failed to send mail to ben@example.org

The basics#

grep ERROR app.log

2026-10-01 09:07:45 ERROR Database connection refused
2026-10-01 09:12:01 ERROR Failed to send mail to ben@example.org

grep prints every line containing the pattern. It's case-sensitive, so the lowercase error line was skipped. The most useful options:

grep -i error app.log

2026-10-01 09:07:45 ERROR Database connection refused
2026-10-01 09:08:02 error payment-service timeout after 30s
2026-10-01 09:12:01 ERROR Failed to send mail to ben@example.org

grep -c -i error app.log
grep -n WARN app.log

3
2:2026-10-01 09:05:12 WARN  Disk usage at 85%

grep -v INFO app.log        # hide the noise

2026-10-01 09:05:12 WARN  Disk usage at 85%
2026-10-01 09:07:45 ERROR Database connection refused
2026-10-01 09:08:02 error payment-service timeout after 30s
2026-10-01 09:12:01 ERROR Failed to send mail to ben@example.org

Context is gold when debugging:

grep -A1 "connection refused" app.log

2026-10-01 09:07:45 ERROR Database connection refused
2026-10-01 09:08:00 INFO  Retrying database connection

Searching many files#

grep -rn TODO src          # recursive, with file names and line numbers

src/app.py:2:    # TODO: add args
src/notes.txt:1:TODO: write docs

grep -rl TODO .                         # just the file names
grep -r --include="*.py" TODO .         # only Python files
grep -r --exclude-dir=node_modules TODO .

grep in a script uses its exit status: 0 if something matched, 1 if not.

grep -q ERROR app.log && echo "errors found"

errors found

And it's the universal filter at the end of a pipe: ps aux | grep nginx, dpkg -l | grep python3, history | grep ssh.

Regular expressions#

A regular expression (regex) is a pattern language. grep understands two dialects: basic (the default) and extended (grep -E). Use -E; it needs fewer backslashes.

Regex * is not the shell's *. In a regex, * means "repeat the previous thing"; "anything" is .*.

Practical patterns

grep -E "ERROR|WARN" app.log | wc -l           # errors or warnings

3

grep -E "^2026-10-01 09:0[0-5]" app.log       # lines from 09:00 to 09:05

2026-10-01 09:00:01 INFO  Server started on port 8080
2026-10-01 09:05:12 WARN  Disk usage at 85%

grep -oE "[0-9]+%" app.log                     # pull out percentages

85%

grep -oE "[[:alnum:]._%+-]+@[[:alnum:].-]+\.[a-z]{2,}" app.log   # extract email addresses

asha@example.com
ben@example.org

The email regex reads: one or more allowed characters, an @, a domain, a literal dot (\.) and at least two letters. (Real-world email validation is harder; this is good enough for searching logs.)

Some more you'll reuse:

grep -vE "^\s*(#|$)" /etc/ssh/sshd_config     # config without comments and blank lines
grep -E "^[0-9]{1,3}(\.[0-9]{1,3}){3}" access.log   # lines starting with an IPv4 address
grep -oP "(?<=port )\d+" app.log               # Perl regex (-P, GNU): prints 8080

The first one is a sysadmin favourite: it shows only the settings that are actually active.

Literal text with -F

When you search for text that contains regex characters, like 1.2.3 or [error] or $PATH, use -F so nothing is special:

grep -F "[error]" nginx.log

Always single-quote patterns that contain $, *, | or \, so the shell leaves them alone.

Beyond grep: ripgrep#

For searching large codebases, ripgrep (rg) is a popular faster alternative: recursive by default, respects .gitignore and skips binary files. Install it with sudo apt install ripgrep (Fedora: sudo dnf install ripgrep) and use it like rg TODO or rg -i "connection refused" /var/log.

Common mistakes#

• Forgetting -E and wondering why +, ? or | don't work.
• Using the shell's * meaning inside a regex (grep "*.log").
• Not escaping the dot: grep "1.5" also matches 105 and 1x5.
• ps aux | grep nginx also lists the grep process itself. Use pgrep -a nginx, or the trick grep [n]ginx.
• Searching binary or huge directories without --exclude-dir.

What's next#

grep becomes even more powerful when you chain it with other commands. Next: pipes and redirection, covering stdin, stdout and stderr, |, >, 2>&1, tee and xargs.