I want to find all lines in several files that match one of two patterns. I tried to find the patterns I'm looking for by typing

grep (foo|bar) *.txt

but the shell interprets the | as a pipe and complains when bar isn't an executable.

How can I grep for multiple patterns in the same set of files?

12 Answers 12

up vote 697 down vote accepted

First, you need to protect the pattern from expansion by the shell. The easiest way to do that is to put single quotes around it. Single quotes prevent expansion of anything between them (including backslashes); the only thing you can't do then is have single quotes in the pattern.

grep 'foo*' *.txt

If you do need a single quote, you can write it as '\'' (end string literal, literal quote, open string literal).

grep 'foo*'\''bar' *.txt

Second, grep supports two syntaxes for patterns. The old, default syntax (basic regular expressions) doesn't support the alternation (|) operator, though some versions have it as an extension, but written with a backslash.

grep 'foo\|bar' *.txt

The portable way is to use the newer syntax, extended regular expressions. You need to pass the -E option to grep to select it. On Linux, you can also type egrep instead of grep -E (on other unices, you can make that an alias).

grep -E 'foo|bar' *.txt

Another possibility when you're just looking for any of several patterns (as opposed to building a complex pattern using disjunction) is to pass multiple patterns to grep. You can do this by preceding each pattern with the -e option.

grep -e foo -e bar *.txt
  • 13
    As a sidenote -- when the patterns are fixed, you should really get into the habit of fgrep or grep -F, for small patterns the difference will be negligible but as they get longer, the benefits start to show... – TC1 Apr 26 '12 at 9:37
  • 5
    @TC1 fgrep is deprecated according to man page – ramn Jul 22 '14 at 8:41
  • 15
    @TC1 Whether grep -F has an actual performance benefit depends on the grep implementation: some of them apply the same algorithm anyway, so that -F makes a difference only to the time spent parsing the pattern and not to the time searching. GNU grep isn't faster with -F, for example (it also has a bug that makes grep -F slower in multibyte locales — the same constant pattern with grep is actually significantly faster!). On the other hand BusyBox grep does benefit a lot from -F on large files. – Gilles Jul 22 '14 at 8:53
  • 3
    Perhaps it should be mentioned that for more complicated patterns where alternation is only to be for a part of the regular expression, it can be grouped with "\(" and "\)" (the escaping is for the default "basic regular expressions") (?). – Peter Mortensen May 20 '15 at 9:45
  • 2
    Note that egrep predates grep -E. It is not GNU specific (it certainly has nothing to do with Linux). Actually, you'll still find systems like Solaris where the default grep still doesn't support -E. – Stéphane Chazelas Jun 7 '16 at 11:27
egrep "foo|bar" *.txt

or

grep "foo\|bar" *.txt
grep -E "foo|bar" *.txt

selectively citing the man page of gnu-grep:

   -E, --extended-regexp
          Interpret PATTERN as an extended regular expression (ERE, see below).  (-E is specified by POSIX.)

Matching Control
   -e PATTERN, --regexp=PATTERN
          Use PATTERN as the pattern.  This can be used to specify multiple search patterns, or to protect  a  pattern
          beginning with a hyphen (-).  (-e is specified by POSIX.)

(...)

   grep understands two different versions of regular expression syntax: “basic” and “extended.”  In  GNU grep,  there
   is  no  difference  in  available  functionality  using  either  syntax.   In  other implementations, basic regular
   expressions are less powerful.  The following description applies to extended regular expressions; differences  for
   basic regular expressions are summarized afterwards.

In the beginning I didn't read further, so I didn't recognize the subtle differences:

Basic vs Extended Regular Expressions
   In basic regular expressions the meta-characters ?, +, {, |, (, and ) lose their special meaning; instead  use  the
   backslashed versions \?, \+, \{, \|, \(, and \).

I always used egrep and needlessly parens, because I learned from examples. Now I learned something new. :)

Like TC1 said, -F seems to be usable option:

$> cat text
some text
foo
another text
bar
end of file

$> patterns="foo
bar" 

$> grep -F "${patterns}" text
foo
bar
  • 1
    @poige I didn't know about the $'foo\nbar' option, not sure how expansion works here, need to look up, but thank you, that is really useful. – haridsv Nov 5 '12 at 12:26
  • Nice! This option also seems to make it run much faster (since it disables regex). – qwertzguy Jan 30 at 0:44

Firstly, you need to use quoting for special characters. Second, even so grep will not understand alternation directly; you would need to use egrep, or (with GNU grep only) grep -E.

egrep 'foo|bar' *.txt

(The parentheses are unnecessary unless the alternation is part of a larger regex.)

  • 4
    Actually, grep -E is more standard than egrep. – jw013 Apr 26 '12 at 1:14

You can try the below command to get the result:

egrep 'rose.*lotus|lotus.*rose' some_file

If you don't need regular expressions, it's much faster to use fgrep or grep -F with multiple -e parameters, like this:

fgrep -efoo -ebar *.txt

fgrep (alternatively grep -F) is much faster than regular grep because it searches for fixed strings instead of regular expressions.

  • 4
    Please see also the comments on this page mentioning that fgrep is deprecated. – phk Dec 27 '16 at 20:21

I had access logs where the dates were stupidly formatted: [30/Jun/2013:08:00:45 +0200]

But I needed to display it as: 30/Jun/2013 08:00:45

The problem is that using "OR" in my grep statement, I was receiving the two match expressions on two separate lines.

Here is the solution:

grep -in myURL_of_interest  *access.log  | \
grep -Eo '(\b[[:digit:]]{2}/[[:upper:]][[:lower:]]{2}/[[:digit:]]{4}|[[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}\b)'   \
| paste - - -d" " > MyAccess.log

I hope it helps :)

A cheap and cheerful way to grep for multiple patterns:

$ echo "foo" > ewq ; echo "bar" >> ewq ; grep -H -f ewq *.txt ; rm ewq
  • It could benefit from an explanation. – Peter Mortensen Dec 1 '17 at 4:12
  • 1
    The explanation is that grep's -f option takes a file with multiple patterns. Instead of creating a temporary file (that you may forget to delete afterwards), just use the shell's process substitution: grep -f <(echo foo; echo bar) *.txt – Jakob Mar 29 at 8:03

Pipe (|) is a special shell character, so it either needs to be escaped (\|) or quoted as per manual (man bash):

Quoting is used to remove the special meaning of certain characters or words to the shell. It can be used to disable special treatment for special characters, to prevent reserved words from being recognized as such, and to prevent parameter expansion.

Enclosing characters in double quotes preserves the literal value of all characters within the quotes

A non-quoted backslash (\) is the escape character.

See: Which characters need to be escaped in Bash?

Here are few examples (using tools not mentioned yet):

  • Using ripgrep:

    • rg "foo|bar" *.txt
    • rg -e foo -e bar *.txt
  • Using git grep:

    • git grep --no-index -e foo --or -e bar

      Note: It also supports Boolean expressions such as --and, --or and --not.

For AND operation per line, see: How to run grep with multiple AND patterns?

For AND operation per file, see: How to check all of multiple strings or regexes exist in a file?

This works for me

root@gateway:/home/sshuser# aws ec2 describe-instances --instance-ids i-2db0459d |grep 'STATE\|TAG'

**STATE**   80      stopped

**STATE**REASON     Client.UserInitiatedShutdown    Client.UserInitiatedShutdown: User initiated shutdown

**TAGS**    Name    Magento-Testing root@gateway:/home/sshuser#

There are multiple ways to do so.

  1. grep 'foo\|bar' *.txt
  2. egrep 'foo|bar' *.txt
  3. find . -maxdepth 1 -type f -name "*.txt" | xargs grep 'foo\|bar'
  4. find . -maxdepth 1 -type f -name "*.txt" | xargs egrep 'foo|bar'

3rd and 4th option will grep only in the files and avoid directories having .txt in their names.
So, as per your use-case you can use any of the option mentioned above.
Thanks!!

TL;DR: if you want to do more things after matching one of the multiple patterns, enclose them as in \(pattern1\|pattern2\)

No one has mentioned searching for any one of multiple patterns followed by more patterns, so I figured I'd throw it out here:

example: I want to find all the places where a variable that contains the name 'date' is defined as a String or int. (i.e., "int date =" or "String date ="):

grep '.' -rne '\(int\|String\) [a-zA-Z_]*date[a-zA-Z_]* ='

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.