grep, sed, and awk form the classic Unix text-processing trinity, each with a distinct role: grep finds lines matching a pattern, sed streams edits through a file transforming text line by line, and awk splits lines into fields and applies programmable pattern-action rules. Together they cover virtually every command-line data-wrangling task — from filtering log files and editing configs in-place to generating formatted reports and joining multi-file datasets. Mastering all three, and knowing when to reach for each, is an essential skill for any Linux engineer, DevOps practitioner, or data scientist working at the shell.
What This Cheat Sheet Covers
This topic spans 12 focused tables and 209 indexed concepts, 130 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: grep Core Options and Flags
The most-used grep flags control what is matched (pattern type, case, whole-word), how matches are counted or listed, and whether surrounding context lines are shown. Flags can be combined freely, e.g. grep -rin pattern dir/.
| Flag | Example | Description | |
|---|---|---|---|
grep -i "error" syslog | • Case-insensitive match • treats uppercase and lowercase as equivalent | ||
grep -v "^#" config.conf | Invert match — print lines that do not match the pattern | ||
grep -r "TODO" ./src/ | • Recurse into directories • does not follow symbolic links | ||
grep -R "TODO" ./src/ | Recurse and dereference symbolic links (alias --dereference-recursive) | ||
grep -E "cat|dog" pets.txt | • Extended regular expressions (ERE) • metacharacters unescaped (alias egrep) | ||
grep -F "2.5.0" CHANGELOG | • Fixed string — no regex, faster • uses Aho-Corasick algorithm (alias fgrep) | ||
grep -P "\d{3}-\d{4}" data.txt | Perl-compatible regex (PCRE): enables \d, lookaheads, \K, named groups | ||
grep -n "fail" app.log | Prefix each matching line with its line number | ||
grep -rl "password" /etc/ | • List filenames that contain a match • suppress line output | ||
grep -L "enabled" *.conf | List filenames that do not contain a match | ||
grep -c "GET" access.log | Print count of matching lines per file, not the lines themselves | ||
grep -oP "\d+\.\d+\.\d+\.\d+" log | Print only the matched portion, one match per line | ||
grep -m 5 "error" big.log | Stop after N matching lines (speeds up search of huge files) | ||
grep -q "root" /etc/passwd && echo yes | • Quiet — no output • exit status only (0 = match found) | ||
grep -w "log" file.txt | Match whole word — pattern bounded by non-word characters | ||
grep -x "exact line" file | Match entire line exactly | ||
grep -A 3 "FATAL" app.log | Show N lines after each match (After context) | ||
grep -B 2 "FATAL" app.log | Show N lines before each match (Before context) | ||
grep -C 2 "FATAL" app.log | Show N lines before and after each match (Context) | ||
grep -H "pattern" *.txt | Always print filename prefix (default when multiple files given) | ||
grep -h "pattern" *.txt | Suppress filename prefix in output | ||
grep -b "pattern" file | Print byte offset of each matching line | ||
grep -rlZ "pw" /etc/ | xargs -0 chmod o-r | • Output NUL-terminated filenames • safe for names containing spaces | ||
grep -e "err" -e "warn" syslog | Specify multiple patterns on one command line | ||
grep -f patterns.txt haystack.txt | Read patterns from a file, one pattern per line | ||
grep -rI "TODO" ./ | Ignore binary files (treat as having no matches) | ||
grep --color=auto "error" log | Highlight matched text with ANSI escape codes |