First Searches

You have a file, and you want the lines that mention something. That is all grep does: it reads text a line at a time and prints the lines that match a pattern. It never changes the file, which is why it is safe to run on anything, and why it ends up in nearly every shell one-liner you will ever write. This chapter covers the everyday core: a plain search, case, inverting, whole words, fixed strings, several patterns, quoting, and the exit status that scripts depend on.

The Shape of a grep Command

The first thing that is not an option is the pattern; everything after it is a file to search. The name comes from an old editor command, g/re/p: globally search for a regular expression and print. A pattern is a regular expression by default, which is powerful and has a catch we will meet in a moment.

Practice Files

Make a new empty folder, change into it, and paste this once. It creates six small files you will use for the whole chapter. (The 'EOF' in quotes stops the shell from changing anything inside.)

Your First Search

Print every line of server.log that contains ERROR:

Two lines. Case matters: the lowercase error: on line 7 was not printed. Add -n to see the line number of each match, which is the quickest way to find your place in a long file:

More than one file, and no file at all

Name several files and grep puts the file name in front of each line, so you can tell where a match came from:

Give it no file and it reads what is piped into it. This is how grep filters the output of other commands:

You will often see cat file | grep pattern. It works, but grep pattern file does the same with one process fewer, and it keeps the file-name prefix when you give several files.

Case and Inversion

-i ignores case. Now the lowercase error: line appears too:

-v inverts the match: print the lines that do not match. Useful for removing noise:

Whole Words: -w and -x

A plain search finds the pattern anywhere: searching for cat would match concatenate, scatter and category. Two options narrow it down:

Look carefully at what -w did. cat-flap matched, because a hyphen is not part of a word. cat_food did not, because an underscore is. Cat and CAT did not, because we did not ask for -i.

Compare -w on the names file, where bob smith counts because bob is a whole word in it:

Fixed Strings: -F

The pattern is a regular expression, and in a regular expression a dot means “any one character”. So looking for 1.2 finds more than you meant:

1x2 matched because the dot matched the x. When you mean the characters exactly as typed, with no special meaning, use -F (fixed string):

The same trap with a price. Without -F, the dot matches the zero in 5000:

Use -F whenever you are searching for a file name, an address, a version number or anything else typed by a person or pasted from somewhere. Regular expressions themselves get their own chapters: grep: Searching Text 3 for grep's flavours, and Learning Regular Expressions for the language in general.

Always Quote the Pattern

The shell reads your command line before grep does. Without quotes, a pattern with a space becomes two words, and grep takes the second as a file name:

Here unexpected was the pattern and token a file that does not exist. Put the pattern in single quotes:

Single quotes pass everything inside exactly as typed. Double quotes still let the shell change $, backticks and backslashes, which is rarely what you want. Make single quotes your default and switch to double quotes only when you deliberately want a shell variable inside the pattern.

More Than One Pattern: -e and -f

Repeat -e to search for several patterns at once; a line matches if it matches any of them:

If the list is long or reused, put one pattern per line in a file and use -f. Our patterns.txt holds ERROR and WARN:

-e has a second job. A pattern that starts with a dash looks like an option. Without -e (or a -- to say “options end here”), grep would try to read -v as the invert flag. Both of these find the line that starts with -v:

Exit Status: How a Script Hears the Answer

Whatever you see on screen, grep also hands back a number when it finishes. In the shell it is $?. Scripts depend on it:

-q (quiet) prints nothing at all and only sets the status, which is exactly what a script wants:

The third one printed an error message from grep, then status 2. Because the status is what if and && look at, you can use grep as a test:

server.log:2 is the number of matching lines (-c, which Chapter 4 covers; with several files each count carries its file name), the grep: line is the complaint about the missing file, and the last line is the status. A script that only checks for “0 or not 0” will take this as a failure even though grep found matches. Chapter 6 comes back to this when we put grep into scripts.

Hands-On Exercises