grep, sed, and awk Cheat Sheet for DevOps

A quick reference for grep, sed, and awk — the text processing trinity. Bookmark this page.

grep — Search Text

# Basic search
grep "error" /var/log/syslog
grep -i "error" log.txt          # Case-insensitive
grep -r "TODO" src/               # Recursive
grep -rn "TODO" src/              # With line numbers

# Regex
grep -E "error|warning" log.txt   # Extended regex (OR)
grep -P "\d{3}-\d{4}" file.txt  # Perl regex

# Invert and count
grep -v "DEBUG" log.txt           # Lines NOT matching
grep -c "error" log.txt           # Count matches

# Context
grep -A 3 "error" log.txt        # 3 lines after
grep -B 2 "error" log.txt        # 2 lines before
grep -C 2 "error" log.txt        # 2 lines around

# Show only matching part
grep -o "\b[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\b" log.txt  # Extract IPs

# File matching
grep -l "error" *.log             # Files containing match
grep -L "error" *.log             # Files NOT containing match

sed — Stream Editor

# Replace (first occurrence per line)
sed 's/old/new/' file.txt

# Replace all occurrences
sed 's/old/new/g' file.txt

# Replace in-place
sed -i 's/old/new/g' file.txt
sed -i.bak 's/old/new/g' file.txt  # With backup

# Delete lines
sed '/pattern/d' file.txt          # Delete matching lines
sed '5d' file.txt                  # Delete line 5
sed '5,10d' file.txt               # Delete lines 5-10

# Insert/append
sed '3i\New line before line 3' file.txt
sed '3a\New line after line 3' file.txt

# Multiple operations
sed -e 's/foo/bar/g' -e 's/baz/qux/g' file.txt

# Print specific lines
sed -n '5p' file.txt               # Print line 5
sed -n '5,10p' file.txt            # Print lines 5-10
sed -n '/start/,/end/p' file.txt   # Print between patterns

awk — Pattern Processing

# Print specific columns
awk '{print $1, $3}' file.txt      # Columns 1 and 3
awk -F: '{print $1, $3}' /etc/passwd  # Custom delimiter

# Filter rows
awk '$3 > 100 {print $1, $3}' data.txt
awk '/error/ {print}' log.txt

# Sum a column
awk '{sum += $2} END {print sum}' data.txt

# Count lines
awk 'END {print NR}' file.txt

# Format output
awk '{printf "%-20s %10d\n", $1, $2}' data.txt

# Unique values
awk '!seen[$1]++ {print $1}' file.txt

# Field separator and OFS
awk -F, 'BEGIN{OFS="\t"} {print $1, $3}' data.csv  # CSV to TSV

# Multi-line processing
awk '/START/,/END/ {print}' file.txt  # Print between patterns

# Built-in variables
# NR = line number, NF = number of fields, $0 = whole line
awk '{print NR, NF, $0}' file.txt

Combined Patterns

# Find errors and extract timestamps
grep "ERROR" app.log | awk '{print $1, $2}'

# Count unique IPs
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10

# Replace in multiple files
find . -name "*.yaml" -exec sed -i 's/v1beta1/v1/g' {} +

# Extract and transform CSV
awk -F, '{print $2 ":" $4}' data.csv | sort -u

Tips and Tricks

• Use grep -P for Perl-compatible regex (lookahead, lookbehind)
• Use sed -i.bak to keep a backup before in-place edits
• Use awk when you need column-based processing — it is more powerful than cut
• Combine all three: grep to filter, sed to transform, awk to analyze
• Use ripgrep (rg) as a faster alternative to grep -r

Related Resources

• Bash Cheat Sheet
• Vim Cheat Sheet
• Linux Cheat Sheet