Grep and Regex Cheat Sheet for Linux Admins

grep is one of the fastest tools for finding text in Linux logs, configuration files, command output, and scripts. Regular expressions make it more powerful, but a long list of patterns can quickly become hard to read.

This cheat sheet groups the most useful grep and regex examples by task: matching text, extracting values, counting results, searching directories, excluding noise, and combining patterns.

Source check – 1 June 2026: The GNU grep manual documents grep options and regex behaviour. It notes that grep supports Basic Regular Expressions, Extended Regular Expressions, fixed strings, and Perl-compatible regular expressions where available.

Command Index

Need	Use	Example	Jump
Basic search	grep	grep 'error' file.log	Go
Extended regex	grep -E	grep -E 'error|failed'	Go
Only the match	grep -o	grep -Eo '[0-9]+'	Go
Count matches	grep -c	grep -c '^$'	Go
Show context	-A, -B, -C	grep -C 3 'bridge0'	Go
Recursive search	grep -r	grep -r 'TODO' .	Go
Exclude lines	grep -v	grep -v '^#'	Go
OR / AND logic	|, repeated grep	grep 'A' file | grep 'B'	Go
Useful patterns	Regex snippets	IP, digits, brackets, tabs	Go

Grep Modes

Choose the matching mode based on the type of pattern you are using.

grep -G 'pattern' file      # Basic Regular Expression, default mode
grep -E 'a|b|c' file        # Extended Regular Expression
grep -F 'literal.string' file # Fixed string, no regex interpretation
grep -P '\d+' file          # Perl-compatible regex, available in GNU grep builds that support it
grep -r 'pattern' /path     # Recursive search

Practical rule: use -E for most admin regex work, -F for literal strings, and -P only when you specifically need PCRE features such as lookbehind.

Basic Search

Case-Insensitive Search

grep -i 'foo' filename

Match a Whole Word

grep -w 'target' filename

Match Lines Starting with a String

grep '^S' filename

Return Only the First Match

grep -m 1 'foo' filename

Extract Values

grep -o returns only the matching text. This is useful when you want the value, not the whole log line.

Extract Integers

grep -Eo '[0-9]+' filename

Extract Exactly Three Digits

grep -Eo '[0-9]{3}' filename

Extract IPv4-Looking Addresses

grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' filename

Note

This pattern extracts IPv4-looking strings. It does not validate that each octet is between 0 and 255.

Extract Text Between Two Words

This uses PCRE lookbehind/lookahead, so it needs GNU grep with -P support.

grep -Po '(?<=w1).*(?=w2)' filename

Extract Text Inside Parentheses

grep -Eo '\([^)]*\)' filename

Counting and Line Numbers

Count Empty Lines

grep -c '^$' filename

Count Matching Lines

grep -c 'foo' filename

Count Every Occurrence

grep -o 'foo' filename | wc -l

Show Matching Line Numbers

grep -n 'foo' filename

Context Lines

Context options are useful for logs because the important detail is often before or after the matching line.

grep -A 3 'bridge0' filename  # 3 lines after the match
grep -B 3 'bridge0' filename  # 3 lines before the match
grep -C 3 'bridge0' filename  # 3 lines before and after

Recursive and Multi-File Search

Search All Files in a Directory

grep -r 'foo' /path/to/search

Hide Filenames in Multi-File Output

grep -rh 'foo' /path/to/search

Return Only Filenames with Matches

grep -rl 'foo' /path/to/search

Skip a Directory

grep -r --exclude-dir='.git' 'foo' .

Exclude Noise

Return Lines Without a Word

grep -v 'foo' filename

Hide Comment Lines

grep -v '^#' file.txt

Combine Patterns

OR Search

grep -E 'error|failed|timeout' filename

AND Search

grep 'error' filename | grep 'database'

Match Patterns from One File Against Another

grep -Ff patterns.txt target-file.txt

Useful Regex Patterns

Need	Pattern	Example command
Any single character between A and B	A.B	grep -E 'A.B' file
Optional character, color or colour	colou?r	grep -E 'colou?r' file
Tab character	\t or shell quoted tab	grep -P '\t' file
Variable-safe search	Quote the variable	grep "$pattern" "$file"
Known code format	AAEL[0-9]{6}-RA	grep -Eo 'AAEL[0-9]{6}-RA' file
Highlight matches	--color=auto	grep --color=auto 'foo' file

Common Grep and Regex Mistakes

• Using * when you mean one or more: [0-9]* can match nothing. Use [0-9]+ with grep -E when you need at least one digit.
• Forgetting quotes: Quote patterns so the shell does not expand special characters before grep sees them.
• Assuming grep -P is everywhere: PCRE support depends on the grep build and platform.
• Using regex for structured data: For JSON, XML, CSV, and logs with strict formats, use a proper parser when accuracy matters.

Related TurboGeek Guides

• How to Master Grep and RegEx
• Linux One-Liners: Useful Commands and Tips
• Understanding Red Hat File System Permissions
• How to Configure Time with NTP and Chronyd

Final Notes

For RHCSA-style work, focus on practical grep skills: exact string searches, recursive searches, line numbers, context, exclusions, counts, and simple extraction. Advanced regex is useful, but reliable administration usually starts with clear, readable patterns.