Linux Text Processing with grep, sed, and awk Cheat Sheet

Updated 2026-05-20

grep, sed, and awk form the classic Unix text-processing trinity, each with a distinct role: grep finds lines matching a pattern, sed streams edits through a file transforming text line by line, and awk splits lines into fields and applies programmable pattern-action rules. Together they cover virtually every command-line data-wrangling task — from filtering log files and editing configs in-place to generating formatted reports and joining multi-file datasets. Mastering all three, and knowing when to reach for each, is an essential skill for any Linux engineer, DevOps practitioner, or data scientist working at the shell.

What This Cheat Sheet Covers

This topic spans 12 focused tables and 209 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: grep Core Options and FlagsTable 2: grep Regex Pattern Matching (BRE / ERE / PCRE)Table 3: grep Multi-File and Recursive OperationsTable 4: sed Substitution and AddressingTable 5: sed Advanced Commands (Delete, Insert, Hold Space, Transform)Table 6: awk Fundamentals — Fields, Separators, and Built-in VariablesTable 7: awk Patterns and ActionsTable 8: awk Output Formatting — print and printfTable 9: awk Arrays, String Functions, and getlineTable 10: Log Analysis PipelinesTable 11: Performance Tips and Common GotchasTable 12: Advanced One-Liners and Real-World Use Cases

Table 1: grep Core Options and Flags

The most-used grep flags control what is matched (pattern type, case, whole-word), how matches are counted or listed, and whether surrounding context lines are shown. Flags can be combined freely, e.g. grep -rin pattern dir/.

Flag	Example	Description
-i	`grep -i "error" syslog`	Case-insensitive match; treats uppercase and lowercase as equivalent
-v	`grep -v "^#" config.conf`	Invert match — print lines that do not match the pattern
-r	`grep -r "TODO" ./src/`	Recurse into directories; does not follow symbolic links
-R	`grep -R "TODO" ./src/`	Recurse and dereference symbolic links (alias `--dereference-recursive`)
-E	`grep -E "cat\|dog" pets.txt`	Extended regular expressions (ERE); metacharacters unescaped (alias `egrep`)
-F	`grep -F "2.5.0" CHANGELOG`	Fixed string — no regex, faster; uses Aho-Corasick algorithm (alias `fgrep`)
-P	`grep -P "\d{3}-\d{4}" data.txt`	Perl-compatible regex (PCRE): enables `\d`, lookaheads, `\K`, named groups
-n	`grep -n "fail" app.log`	Prefix each matching line with its line number
-l	`grep -rl "password" /etc/`	List filenames that contain a match; suppress line output
-L	`grep -L "enabled" *.conf`	List filenames that do not contain a match
-c	`grep -c "GET" access.log`	Print count of matching lines per file, not the lines themselves
-o	`grep -oP "\d+\.\d+\.\d+\.\d+" log`	Print only the matched portion, one match per line
-m N	`grep -m 5 "error" big.log`	Stop after N matching lines (speeds up search of huge files)
-q	`grep -q "root" /etc/passwd && echo yes`	Quiet — no output; exit status only (0 = match found)

Table 1: grep Core Options and Flags

Flag	Example	Description
-i	`grep -i "error" syslog`	Case-insensitive match; treats uppercase and lowercase as equivalent
-v	`grep -v "^#" config.conf`	Invert match — print lines that do not match the pattern
-r	`grep -r "TODO" ./src/`	Recurse into directories; does not follow symbolic links
-R	`grep -R "TODO" ./src/`	Recurse and dereference symbolic links (alias `--dereference-recursive`)
-E	`grep -E "cat\|dog" pets.txt`	Extended regular expressions (ERE); metacharacters unescaped (alias `egrep`)
-F	`grep -F "2.5.0" CHANGELOG`	Fixed string — no regex, faster; uses Aho-Corasick algorithm (alias `fgrep`)
-P	`grep -P "\d{3}-\d{4}" data.txt`	Perl-compatible regex (PCRE): enables `\d`, lookaheads, `\K`, named groups
-n	`grep -n "fail" app.log`	Prefix each matching line with its line number
-l	`grep -rl "password" /etc/`	List filenames that contain a match; suppress line output
-L	`grep -L "enabled" *.conf`	List filenames that do not contain a match
-c	`grep -c "GET" access.log`	Print count of matching lines per file, not the lines themselves
-o	`grep -oP "\d+\.\d+\.\d+\.\d+" log`	Print only the matched portion, one match per line
-m N	`grep -m 5 "error" big.log`	Stop after N matching lines (speeds up search of huge files)
-q	`grep -q "root" /etc/passwd && echo yes`	Quiet — no output; exit status only (0 = match found)