Grep Multiple Strings

The short answer

To match multiple strings or patterns at once with [.inline-code]grep[.inline-code], you can either repeat the [.inline-code]-e[.inline-code] flag multiple times:

$ grep -e 'pattern' [-e 'pattern'] <file>

Or you can use the [.inline-code]\|[.inline-code] separator:

$ grep 'pattern[\|pattern]' <file>

For example, both of these commands will search for the strings [.inline-code]ERROR[.inline-code] and [.inline-code]WARNING[.inline-code] in the [.inline-code]logs.txt[.inline-code] file and output the matching lines:

$ grep -e 'ERROR' -e 'WARNING' logs.txt
$ grep 'ERROR\|WARNING' logs.txt

Note that, by default, [.inline-code]grep[.inline-code] is case sensitive. You can learn more about that by reading our other article on how to make grep case insensitive.

[#use-extended-regular-expressions] Using extended regular expressions [#use-extended-regular-expressions]

To enable [.inline-code]grep[.inline-code] to use the extended regular expression syntax (like [.inline-code]egrep[.inline-code] would) , you can use the [.inline-code]-E[.inline-code] flag instead of the [.inline-code]-e[.inline-code] flag as follows:

$ grep -E 'pattern[|pattern]' <file>

Note that when using this flag, you don't need to escape the [.inline-code]|[.inline-code] pattern separator.

For example, considering the following [.inline-code]logs[.inline-code] file:

$ cat logs
2024-05-01 | ERROR 401 | Login failure
2024-05-06 | INFO 200 | Login success
2024-06-22 | INFO 201 | Account created
2024-06-01 | ERROR 404 | Page not found
2024-06-01 | WARN 429 | Request limit reached
2024-06-03 | ERROR 404 | Page not found

This command will output all the lines containing the string [.inline-code]ERROR[.inline-code] followed by a space character and 3-digit numbers:

$ grep -E 'ERROR [0-9]{3}' logs
2024-05-01 | ERROR 401 | Login failure
2024-06-01 | ERROR 404 | Page not found
2024-06-03 | ERROR 404 | Page not found

And this command will output all the lines starting with [.inline-code]2024-06[.inline-code], followed by two digit numbers, followed by the [.inline-code]ERROR[.inline-code] or [.inline-code]WARN[.inline-code] string:

$ grep -E '^2024-06-[0-9]{2} \| (ERROR|WARN)' logs
2024-06-01 | ERROR 404 | Page not found
2024-06-01 | WARN 429 | Request limit reached
2024-06-03 | ERROR 404 | Page not found

[#easily-recall-syntax-with-ai] Easily retrieve this command using Warp’s AI Command Suggestions [#easily-recall-syntax-with-ai]

If you’re using Warp as your terminal, you can easily retrieve this command using the Warp AI Command Suggestions feature:

Entering [.inline-code]grep multiple patterns[.inline-code] in the AI Command Suggestions will prompt a [.inline-code]grep[.inline-code] command that can then be quickly inserted in your shell by doing CMD+ENTER .

[#load-patterns-from-a-file] Searching for patterns stored in a text file [#load-patterns-from-a-file]

To search for a list of patterns stored in the file, you can use the [.inline-code]-f[.inline-code] flag as follows:

$ grep -f <patterns> <file>

For example, this command will load a list of patterns contained in the [.inline-code]patterns.txt[.inline-code] file and match them against the lines of the [.inline-code]logs.txt[.inline-code] file:

$ grep -f patterns.txt logs.txt

Extracting text before, after, and between patterns

[#extract-text-before-a-pattern] Extracting text before a pattern [#extract-text-before-a-pattern]

To extract the text before a specified pattern, you can use the [.inline-code]grep[.inline-code] command with the [.inline-code]-oP[.inline-code] flags and the [.inline-code]?=[.inline-code]expression as follows:

$ grep -oP 'value(?=pattern)' <file>

For example, considering the following [.inline-code]logs[.inline-code] file:

$ cat logs
2024-06-18 12:34:56 INFO UserID=12345 Action=Login
2024-06-18 12:35:00 ERROR UserID=67890 Action=Timeout
2024-06-18 12:35:05 WARN UserID=54321 Action=Retry

This command will extract the text before the [.inline-code] ERROR[.inline-code] or [.inline-code] WARN[.inline-code] strings:

$ grep -oP '.*(?= ERROR|WARN)' logs
2024-06-18 12:35:00
2024-06-18 12:35:05

[#extract-text-after-a-pattern] Extracting text after a pattern [#extract-text-after-a-pattern]

On the other hand, to extract the text after a specified pattern, you can use the [.inline-code]?<=[.inline-code] expression instead:

$ grep -oP '(?<=pattern)value' <file>

For example, considering the following [.inline-code]logs[.inline-code] file:

$ cat logs
2024-06-18 12:34:56 INFO UserID=12345 Action=Login
2024-06-18 12:35:00 ERROR UserID=67890 Action=Timeout
2024-06-18 12:35:05 WARN UserID=54321 Action=Retry

This command will extract the text after the [.inline-code]Action=[.inline-code] string:

$ grep -oP '(?<=Action=).*' logs
Login
Timeout
Retry

[#extract-text-between-patterns] Extracting text between two patterns [#extract-text-between-patterns]

To extract the text between two patterns, you can combine the two previous expressions as follows:

$ grep -oP '(?<=pattern)value(?=pattern)' <file>

For example, considering the following [.inline-code]logs[.inline-code] file:

$ cat logs
2024-06-18 12:34:56 INFO UserID=12345 Action=Login
2024-06-18 12:35:00 ERROR UserID=67890 Action=Timeout
2024-06-18 12:35:05 WARN UserID=54321 Action=Retry

This command will extract the text located between the [.inline-code]UserID=[.inline-code] and [.inline-code] Action[.inline-code] strings:

$ grep -oP '(?<=UserID=).*(?= Action)' logs
12345
67890
54321