Multiple String Search in a File Using Grep

Last updated: August 1, 2023 | Nitish Singh

The grep is a powerful tool in Linux for searching text, particularly when used with regular expressions. Here we learn the different ways the grep command can be used to search for multiple strings or patterns in files.

Using -e Option

Using -e option with grep command you can specify multiple patterns to match.

Example:

grep -e Linux -e awesome samplefile.txt
searching multiple patterns using -e

This command searches multiple patterns such as "Linux" and "awesome" in the samplefile.txt.

Note: Useful options such as -i to ignore case and -w to match the exact word can be combined to get your desired results.

Using -f Option

Another way to search multiple patterns is by specifying patterns in a file for grep to read from.

Example:

grep -f mypatterns.txt samplefile.txt
search multiple patterns from a file

In this command, grep will read each line in mypatterns.txt as a separate pattern and search for these patterns in samplefile.txt. If the pattern file contains an empty line, grep matches that as well.

Using Regular expression

You can use grep with default basic regular expressions or extended regular expressions to search for multiple strings or patterns. For this, you can make use of OR operator ("|''), simulate AND operator, grouping, character classes, wildcard, etc.

Using the OR operator:

The following grep command search for lines containing either "error" or Failed in the auth.log file.

sudo grep -E 'error|Failed' auth.log
or
sudo grep 'error\|Failed' auth.log
using OR operator

Here we have used '|' character for specifying OR condition. Both command does the same. For the basic regular expression the '|' character must be escaped using backslash.

Grouping:

Parentheses ('()') can be used to group parts of a regular expression. For example, if you want to search for lines that contain "port" followed by either "56148" or "58965", you can use the following command:

sudo grep -E 'port (56148|58965)' auth.log
using regular expression grouping

Matching any sequence of characters using .*

In regular expression when wildcard character ('.') used along with asterisk it can match zero or more of the preceding character. For example If you want to match any lines that contain "password" followed by any sequence of characters, followed by "root", you can use the following command:

sudo grep 'password.*root' auth.log
matching multiple patterns using .*

Using AND operation

In regular expression, there is no specific operator like OR operator for AND operation. Instead, we can do some workarounds to simulate AND operation.

First workaround: Chain multiple grep command

Example:

sudo grep 'error' auth.log | grep 'read'
Chain multiple grep command to search for multiple strings

Here this executes the grep command, which searches the auth.log file for lines containing the string 'error'. Then takes the output piped from the previous command and searches it for lines containing the string 'read'. Finally, the output contains lines that match both "error" and Failed".

Second workaround: Using lookaheads in Perl-Compatible Regular Expressions (PCRE) with -P option

Example:

sudo grep -P '(?=.error)(?=.Failed)' auth.log

Here we have used (?=...) is a positive lookahead to check if there's a match to its right. And .* matches any number of any characters. Therefore, this command will match lines that contain both "error" and "Failed", regardless of their order or the number of characters between them.

SHARE

Comments

Please add comments below to provide the author your ideas, appreciation and feedback.

Leave a Reply

Leave a Comment