INPUT · Slides

Search by the words inside

01 / 09

What if you do not know the name?

find was the tool for searching by name. But you do not always remember a thing by its name.

"Which log was it that had the error in it?"
"Which diary entry was the one where I wrote about ramen?"

That is when you use grep. It reads what is inside a file and puts out the lines with that word in them.

02 / 09

grep — pick lines out of the contents

The shape is this.

grep word-to-look-for file

What comes out is the line containing that word, as it is. Not a line number, not a file name — the contents.

The first move when looking at a log is almost always this. However many thousand lines there are, only the ones with the word you care about are left.

~ $ grep ERROR log/access.log10:02 ERROR disk full10:05 ERROR network down

03 / 09

When it finds nothing, it says nothing

When grep finds nothing, it puts out nothing at all. No error either.

At first you think it is broken, but that is its answer: "I looked and it was not there". find was the same.

UNIX tools are often built so that saying nothing is the good news. When it worked, it stays quiet.

04 / 09

`-i` ignores upper and lower case

grep ERROR only picks up a capitalised ERROR. A line written error in lower case slips past.

Searching without caring is -i, the same idea as -iname on find.

Getting into the habit of adding -i when you read logs is a good move. Whoever wrote them will have been inconsistent about capitals.

~ $ grep -i error log/access.log10:02 ERROR disk full10:04 error timeout10:05 ERROR network down

05 / 09

A handful of flags to learn

grep gets more useful the more flags (options) you know. Start with these five.

-n — add line numbers (so you can go back and fix it)
-v — put out the lines without the word
-c — put out just the count, no lines
-l — put out just the file names, not the contents
-w — only lines where it matches as a whole word

Flags can be stuck together. -i -n can be written -in.

~ $ grep -n ERROR log/access.log3:10:02 ERROR disk full6:10:05 ERROR network down

06 / 09

`-v` is subtraction

-v does the opposite. It puts out the lines that do not have the word.

That is what you want when you are getting rid of the noise. Take INFO out of a log and what is left is only the lines worth worrying about.

grep -v INFO log/access.log

It is not only for finding things — it is also for throwing away what you do not want. That is grep's other face.

07 / 09

`-r` dives down and searches

When you cannot name the file, use -r. It dives through everything in a box and searches.

grep -r ramen .

The shape of the output changes to file name:line, so you can tell which file it is talking about.

Here is how to choose between them. Searching by name is find, searching by contents is grep.

~ $ grep -r ramen diarydiary/january.txt:Jan 5 had ramendiary/january.txt:Jan 20 a new ramen placediary/february.txt:Feb 14 made ramen

08 / 09

It works on a stream too

grep works on something poured in through a pipe as well, with no file name written at all.

ls | grep .txtcat log/access.log | grep ERROR

This shape matters a lot. Being able to narrow another tool's result with grep means you can sieve any output at all.

Joining things up gets covered properly in the next chapter.

09 / 09

Now have a go

log/access.log holds 7 lines of log. ERROR appears in capitals on two lines and as lower case error on one.

diary has two entries in it, and both of them mention ramen.

When it finds nothing, grep stays quiet. Have a look at that too.