103.7 Search text files using regular expressions

Introduction

This lesson is about regular expressions.

The main question is:

How do you search for patterns in text instead of searching only for exact words?

What you should be able to do after this lesson:

• Recognize common regex building blocks.
• Understand anchors, classes, and quantifiers.
• Know the difference between basic and extended regex in simple terms.
• Use grep and sed with regex.

Big Idea: Regex Means "Describe a Pattern"

Instead of asking for one exact string, you describe what matching text should look like.

Examples:

• starts with a
• ends in .log
• contains only digits

Common Building Blocks

Any one character

.

Start of line

^

End of line

$

Character class

[abc]
[0-9]
[A-Za-z]

Repetition

*
+
?
{m,n}

Basic vs Extended Regex

This confuses many beginners, so keep it simple.

Basic regular expressions

Often used by plain grep. Some special characters need more escaping.

Extended regular expressions

Often used by grep -E. They are usually easier to read for patterns using +, ?, and |.

For LPIC-1, the key point is:

BRE and ERE are similar ideas, but some operators are written more simply in ERE

grep Examples

Lines starting with root

grep '^root' /etc/passwd

Example output:

root:x:0:0::/root:/usr/bin/bash

What this shows:

• ^root matches only lines that begin with root
• anchors make a regex search more precise

Lines ending in bash

grep 'bash$' /etc/passwd

Use extended regex

grep -E 'error|warning' logfile.txt

Literal search

Historical command:

fgrep 'a+b' file.txt

Modern equivalent:

grep -F 'a+b' file.txt

Search recursively through files

grep -R 'error' /var/log

This is useful when the pattern may appear in many files, not just one.

sed Substitution

Regex is also used to change text.

echo "color" | sed 's/color/colour/'
echo "abc123" | sed 's/[0-9]/X/g'

Example output:

abcXXX

What this shows:

• [0-9] matches digits
• the g flag replaces every matching digit on the line

Read s/old/new/ as:

• substitute old with new

Regex Examples in Plain English

• ^root = line starts with root
• txt$ = line ends with txt
• [0-9]+ = one or more digits
• ^[A-Za-z]+$ = only letters, from start to end

Basic and Extended Regex: A Practical Reminder

If you are unsure which mode you need, remember:

• plain grep = basic regex style
• grep -E = extended regex style
• grep -F = no regex, fixed strings only

That small distinction solves many beginner mistakes.

Practice Step by Step

1) Find login shells in `/etc/passwd`

1. Run: grep 'sh$' /etc/passwd
2. Read it as: lines that end with sh.

2) Find lines with either "error" or "warning"

1. Run: grep -E 'error|warning' logfile.txt
2. Read it as: match "error" or "warning".

Cheat Sheet

• . = any single character
• ^ = start of line
• $ = end of line
• [abc] = one character from a set
• [0-9] = one digit
• * = zero or more
• + = one or more
• ? = zero or one
• grep = search with patterns
• grep -E = extended regex
• grep -F or fgrep = fixed strings
• sed 's/old/new/' = substitute text