I have a program which spits out an output to stdout like:

[OK]      Something is ok
[OK]      Something else is also ok
[FAIL]    This does not look good
[FAIL]    Neither does this
[OK]      At least this is fine

To more easy spot the fails from the output I would like to mark the occurrences of the keyword FAIL with red without discarding the other messages. It would be nice if I could also highlight the OK keywords with green :).

Doing a pipe to egrep --color FAIL will only show the lines where the FAIL keyword is present.


Based on manatwork's brilliant little "or nothing" hack in the other question, I offer this, which adds the ability to get two highlight colors:

 $ myprogram | \
   GREP_COLORS='mt=01;32' egrep --color=always '\[OK\]|' | \
   GREP_COLORS='mt=01;31' egrep --color=always '\[FAIL\]|'

That is, you run grep over the output twice, with a different GREP_COLORS environment variable each time.

The '01;32' value means "bold green", and the other means "bold red". See the Wikipedia article on ANSI codes for more ideas.

Alas, this requires GNU grep version 2.5.3 or higher. Older versions of GNU grep supported a different coloring mechanism, but those versions have a bug that prevents you from using the feature in a pipeline more than once. BSD grep emulates the older GNU grep coloring mechanism, and it will work twice in a pipeline, but it yells about "empty sub-expression" due to the manatwork hack.

You can remove the backslashes at the end of the first two lines to make it all a single line. I've just split it here for clarity and to play nice with the SE page format.

  • Thats brilliant indeed! But for some reason the script does not seem to highlight the second statement on my machine. I'm running CentOS 5. – Theodor Nov 1 '12 at 17:46
  • 2
    What's happening here is that CentOS 5 ships a GNU grep old enough that it doesn't support GREP_COLORS, plural. It uses the older GREP_COLOR method only, and that method has a bug in it that prevents it from doing the right thing. If you change the command to use GREP_COLOR=32 and such, it will change the highlight color of the first match only. If you pipe the result through hexdump -c you can see that adding the second egrep command does do something, but it isn't legal ANSI. Bottom line: you have to upgrade grep to get this to work right. – Warren Young Nov 1 '12 at 18:44
  • Haha that's such an insightful comment. Yeah CentOS5 is getting kind of old, as with many OS:s running on old machine spitting out old, god forsaken log messages :) I'll try to see if an upgrade to centos6 is not possible. – Theodor Nov 1 '12 at 19:06
  • I've just checked my solution on a CentOS 6 box, and it does work there, confirming my diagnosis. (Earlier tests were on Ubuntu servers.) EL6 ships with GNU grep 2.6.3. Interestingly, they did also fix the GREP_COLOR (singular) bug, even though the feature was deprecated as soon as replaced. – Warren Young Nov 1 '12 at 21:27
  • I can't understand how this solves the problem since the 1st grep will filter out all the "FAIL" so there will be nothing left for the second grep to match.. – laertis Jan 20 '17 at 13:53

You can use multitail or ccze for this, both allow configs to describe regexps to match and colors.


Based on Warren Young's answer, I wrote this Python script that does the same thing more elegantly and with a lot less typing. So this is how you'd use that script:

cat yourfile | himul '\[OK\]' '\[FAIL\]'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.