grep Command
Beginner Text Processing man(1)Search text using patterns (regular expressions)
👁 13 views
📅 Updated: Mar 15, 2026
SYNTAX
grep [OPTION]... PATTERN [FILE]...
What Does grep Do?
The grep command searches for text patterns in files and input streams using regular expressions. It is one of the most powerful and frequently used text processing tools in Linux, essential for log analysis, code searching, and data filtering.
grep supports basic regular expressions (BRE) by default, extended regular expressions (ERE) with -E, and Perl-compatible regular expressions (PCRE) with -P. It can search single files, multiple files, entire directory trees, and piped input from other commands.
The command outputs matching lines by default, but can also show line numbers, surrounding context, only filenames, match counts, or inverted matches. grep is commonly combined with pipes to filter output from other commands like ps, ls, find, and log files.
grep supports basic regular expressions (BRE) by default, extended regular expressions (ERE) with -E, and Perl-compatible regular expressions (PCRE) with -P. It can search single files, multiple files, entire directory trees, and piped input from other commands.
The command outputs matching lines by default, but can also show line numbers, surrounding context, only filenames, match counts, or inverted matches. grep is commonly combined with pipes to filter output from other commands like ps, ls, find, and log files.
Options & Flags
| Option | Description | Example |
|---|---|---|
| -i | Case-insensitive search | grep -i "error" /var/log/syslog |
| -r, -R | Search recursively through directories | grep -r "TODO" /var/www/ |
| -n | Show line numbers with matches | grep -n "function" script.py |
| -v | Invert match — show lines that do NOT match | grep -v "^#" config.conf |
| -c | Count the number of matching lines | grep -c "ERROR" application.log |
| -l | Show only filenames containing matches | grep -rl "deprecated" src/ |
| -E | Use extended regular expressions (same as egrep) | grep -E "error|warning|critical" log.txt |
| -w | Match whole words only | grep -w "port" config.yml |
| -A n | Show n lines after each match | grep -A 3 "Exception" error.log |
| -B n | Show n lines before each match | grep -B 5 "FATAL" app.log |
| -C n | Show n lines of context around each match | grep -C 2 "segfault" kern.log |
| --include | Search only files matching a pattern | grep -r --include="*.php" "function" src/ |
Practical Examples
#1 Search for a string in a file
Finds all lines containing "error" in the syslog file.
$ grep "error" /var/log/syslog
Output:
Mar 14 09:23:01 server error: connection refused
#2 Case-insensitive recursive search
Searches all files under /etc/ for "password" regardless of case.
$ grep -ri "password" /etc/#3 Find lines NOT matching a pattern
Shows active configuration lines by removing comments and empty lines.
$ grep -v "^#" /etc/ssh/sshd_config | grep -v "^$"#4 Count error occurrences
Counts how many 404 errors appear in the access log.
$ grep -c "404" access.log
Output:
247
#5 Search with context
Shows 2 lines before and 5 lines after each Exception match — essential for debugging.
$ grep -B 2 -A 5 "Exception" /var/log/app.log#6 Filter process list
Filters running processes to show only nginx-related entries.
$ ps aux | grep nginx
Output:
root 1234 0.0 0.1 nginx: master process
#7 Search specific file types recursively
Searches only Python files for import statements, with line numbers.
$ grep -rn --include="*.py" "import requests" .
Output:
./api/client.py:3:import requests
#8 Use extended regex for multiple patterns
Matches any of the three log levels using alternation.
$ grep -E "(WARN|ERROR|FATAL)" application.logTips & Best Practices
Use --color for highlighted matches: Add --color=auto (or alias grep="grep --color=auto" in .bashrc) to highlight matching text in the output.
grep vs ripgrep: For large codebases, consider ripgrep (rg) which is significantly faster and respects .gitignore by default. Syntax is very similar to grep.
Avoid grep grep in ps output: When using ps aux | grep process, the grep command itself shows up. Use ps aux | grep [p]rocess or pgrep instead.
Frequently Asked Questions
How do I search for a string in all files in a directory?
Use grep -r "pattern" /path/to/directory. Add --include="*.ext" to limit to specific file types.
What is the difference between grep, egrep, and fgrep?
egrep is equivalent to grep -E (extended regex with +, ?, |, () without escaping). fgrep is grep -F (fixed strings, no regex). Plain grep uses basic regex (BRE).
How do I search for multiple patterns at once?
Use grep -E "pattern1|pattern2|pattern3" or use multiple -e flags: grep -e "pattern1" -e "pattern2" file.txt.
Related Commands
More Text Processing Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →