Linux 'grep'

· 3 min read · #linux #grep #cli · @linux

Preview

grep is the fastest way to filter lines that match a pattern across files, directories, or streams. This guide focuses on GNU grep with production-ready examples.

TL;DR (Cheatsheet)

  • Basic: grep PATTERN file
  • Case-insensitive: -i
  • Line numbers: -n
  • Count only: -c
  • Filenames only: -l (inverse -L)
  • Matched text only: -o
  • Extended regex: -E
  • Fixed string (no regex, faster): -F
  • Invert match: -v
  • Recursive: -r (no symlinks), -R (follow symlinks)
  • Context: -B N, -A N, -C N
  • Include/exclude globs: --include, --exclude, --exclude-dir
  • Color: --color=auto (force with --color=always)
  • Skip binaries: -I
  • NUL-safe piping: -Z (use with xargs -0)

Core Patterns You’ll Actually Use

# Recursive search with file filters
grep -Rni --include='*.log' --exclude-dir='.git' 'ERROR' .

# Count matches per file (quick signal for CI)
grep -Rc --include='*.py' 'TODO' src/

# Show only the matched portion (e.g., HTTP status in journal)
journalctl -u nginx | grep -oE 'status=[0-9]{3}'

# Word boundary search (avoid over-matching)
grep -rw --include='*.c' '\<init\>' src/

# Literal text (fast, ignores regex metacharacters)
grep -F '[INFO]' app.log

# Safe with odd filenames (spaces/newlines)
find . -name '*.md' -print0 | xargs -0 grep -n 'architecture'

Performance That Matters

  • Prefer -F for literal patterns (often much faster).

  • Use LC_ALL=C for byte-wise matching and speed on huge inputs:

    LC_ALL=C grep -rF 'needle' /data/terabytes
  • Skip binaries with -I or --binary-files=without-match.
  • Stop early with -m N when you only need the first N hits.
  • In pipelines where latency matters, some tools support --line-buffered; GNU grep auto-flushes on line end, but overall pipeline buffering still applies.

Regex Primer (Just Enough)

  • -E (ERE): foo|bar, a{2,5}, colou?r, (ba|be)z.

  • -P (PCRE) for lookarounds:

    grep -Po '(?<=user=)[^ &]+' access.log

    Note: -P may be missing on stock BSD/macOS grep. Use GNU grep (e.g., Homebrew ggrep) or rewrite with awk/sed.

Context & Reporting

# Show surrounding lines (2 before/after)
grep -nC2 'panic' kernel.log

# Only filenames that contain matches
grep -Rl 'TODO' src/

# Suppress filenames (multi-file, lines only)
grep -h 'pattern' file1 file2

Real-World Mini Cookbook

# 1) Summarize error bursts with context around each match
grep -Rni --include='*.log' 'CRITICAL' logs/ | sed -n 's/:.*//p' | sort -u \
 | xargs -I{} sh -c "echo '--- {} ---'; grep -nC2 'CRITICAL' {}"

# 2) Extract JSON values (simple cases)
grep -Po '"user_id"\s*:\s*"\K[^"]+' events.jsonl | sort | uniq -c | sort -nr | head

# 3) Find lines NOT matching (e.g., exclude health checks)
grep -R 'GET /' access.log | grep -v '/healthz'

Cross-Platform Notes

  • GNU vs BSD (macOS) differences:

    • -P often unavailable on BSD grep.
    • Some long options vary; always man grep.
    • Install GNU grep if you need PCRE or consistent behavior.

Common Pitfalls (and Fixes)

  • Regex when you wanted literal → use -F.
  • Locale surprises / poor performance on huge inputs → LC_ALL=C.
  • Recursive slowness → narrow with --include/--exclude and prefer -F.
  • Useless use of cat → grep pattern file (pipe only when needed).