The grep is a powerful tool in Linux for searching text, particularly when used with regular expressions. Here we learn the different ways the grep command can be used to search for multiple strings or patterns in files.
Using -e Option
Using -e option with grep command you can specify multiple patterns to match.
Example:
grep -e Linux -e awesome samplefile.txt
This command searches multiple patterns such as "Linux" and "awesome" in the samplefile.txt.
Note: Useful options such as -i to ignore case and -w to match the exact word can be combined to get your desired results.
Using -f Option
Another way to search multiple patterns is by specifying patterns in a file for grep to read from.
Example:
grep -f mypatterns.txt samplefile.txt
In this command, grep will read each line in mypatterns.txt as a separate pattern and search for these patterns in samplefile.txt. If the pattern file contains an empty line, grep matches that as well.
Using Regular expression
You can use grep with default basic regular expressions or extended regular expressions to search for multiple strings or patterns. For this, you can make use of OR operator ("|''), simulate AND operator, grouping, character classes, wildcard, etc.
Using the OR operator:
The following grep command search for lines containing either "error" or Failed in the auth.log file.
sudo grep -E 'error|Failed' auth.logorsudo grep 'error\|Failed' auth.log
Here we have used '|' character for specifying OR condition. Both command does the same. For the basic regular expression the '|' character must be escaped using backslash.
Grouping:
Parentheses ('()') can be used to group parts of a regular expression. For example, if you want to search for lines that contain "port" followed by either "56148" or "58965", you can use the following command:
sudo grep -E 'port (56148|58965)' auth.log
Matching any sequence of characters using .*
In regular expression when wildcard character ('.') used along with asterisk it can match zero or more of the preceding character. For example If you want to match any lines that contain "password" followed by any sequence of characters, followed by "root", you can use the following command:
sudo grep 'password.*root' auth.log
Using AND operation
In regular expression, there is no specific operator like OR operator for AND operation. Instead, we can do some workarounds to simulate AND operation.
First workaround: Chain multiple grep command
Example:
sudo grep 'error' auth.log | grep 'read'
Here this executes the grep command, which searches the auth.log file for lines containing the string 'error'. Then takes the output piped from the previous command and searches it for lines containing the string 'read'. Finally, the output contains lines that match both "error" and Failed".
Second workaround: Using lookaheads in Perl-Compatible Regular Expressions (PCRE) with -P option
Example:
sudo grep -P '(?=.error)(?=.Failed)' auth.logHere we have used (?=...) is a positive lookahead to check if there's a match to its right. And .* matches any number of any characters. Therefore, this command will match lines that contain both "error" and "Failed", regardless of their order or the number of characters between them.
About The Author
Nitish Singh
Nitish Singh is a certified C1 Advanced(CEFR) tech writer from Kolkata, India. He has a proven track record of making tech accessible to everyone, with his work being read by over a million users worldwide. With a master’s degree in computer science and a history of research and publication, he has worked in various roles, such as content manager, news writer, blockchain writer, and Linux enthusiast. He loves Linux to its kernel and learns new Linux concepts daily.
Comments