Linux CLI 41 🐧 regular expressions - KandZ

grep -E '[0-9 ][0-9 ]' numbers.txt

grep -E '^[aeiouAEIOU ]' vowels.txt

sed -E 's/f([a-z ])o\1d/b&r/' input.txt > output.txt

awk '/^[0-9 ]/ && /a/' data.txt

awk '{gsub(/f([a-z ])o\1d/, "b&r"); print}' input.txt > output.txt

grep -E '\.com' domains.txt

ls /home/kr/cli/[[:upper: ] ]*

ls /home/kr/cli/[[:digit: ] ]*

Regular expressions (regex) are the language of pattern matching on Linux. They let you describe what you’re looking for — not the exact characters — and every major text tool understands them: grep, sed, awk, find, and even the shell itself. Learn regex once and you’ll use it everywhere.

Key point: There are two dialects — Basic (BRE) and Extended (ERE). grep defaults to BRE; add -E for ERE. sed defaults to BRE; add -E for ERE. awk uses ERE by default. Knowing which one you’re in prevents a lot of confusion.

a – regular expressions and POSIX metacharacters 1/2

Regular expressions are powerful tools for pattern matching and text manipulation. You can use regex with various commands like grep, sed, awk, and even directly in the shell. You can use literal characters (abcdef...) but also metacharacters — characters with special meaning.

Basic regex metacharacters (BRE):

Metacharacter	Meaning	Example
`.`	Matches any single character	`f..d` matches `food`, `fard`, but not `foot`
`^`	Matches at the start of the line	`^foo` matches lines starting with `foo`
`$`	Matches at the end of the line	`bar$` matches lines ending with `bar`
`[ ]`	Matches any character within the brackets	`[ aeiou ]` matches any vowel
`[ ^ ]`	Matches any character not in the brackets	`[ ^0-9 ]` matches any non-digit
`*`	Matches 0 or more of the preceding element	`fo*d` matches `fd`, `food`, `fod` — but not `fed`
`\`	Escapes a metacharacter	`\.` matches a literal dot

Explaining each one:

. — any character

$ grep 'f..d' words.txt
food
fard
feed
# Matches any single char between f and d
# Does NOT match "foot" (only 2 chars between f and d would be "oo")

^ — start of line

$ grep '^foo' lines.txt
foobar
foo and more
# Only lines that BEGIN with "foo"

$ — end of line

$ grep 'bar$' lines.txt
foobar
rabar
# Only lines that END with "bar"

[ ] — character class

$ grep '[aeiou ]' words.txt
cat
dog
fish
# Matches any line containing a vowel

[ ^ ] — negated class

$ grep '[^0-9 ]' codes.txt
abc
xyz
# Lines containing at least one non-digit

* — zero or more

$ grep 'fo*d' words.txt
fd
food
fod
# f, then zero or more o's, then d
# Does NOT match "fed" — the middle char must be "o" or nothing

\ — escape

$ grep '\.' file.txt
example.com
version 1.0
# Matches a literal dot, not "any character"

b – regular expressions and metacharacters 2/2

Extended regex (ERE) adds more powerful operators. Use grep -E, sed -E, or awk (which uses ERE by default).

Metacharacter	Meaning	Example
`( )`	Grouping — subexpressions and backreferences	`(foo)bar` matches `foobar`
`{n}`	Exactly n occurrences	`o{2}` matches exactly `oo`
`{n,m}`	Between n and m occurrences	`o{1,3}` matches 1–3 `o`s
`?`	0 or 1 occurrence	`fo?d` matches `fd` and `fod`, not `food`
`+`	1 or more occurrences	`fo+d` matches `food` and `fod`, not `fd`
`\|`	Alternation — OR	`foo\|bar` matches `foo` or `bar`

Explaining each one:

( ) — grouping and backreferences

$ echo "foobar" | grep -E '(foo)bar'
foobar
# Group (foo) followed by literal "bar"

# Backreference — \1 refers to the first group
$ grep -E '(f.)(o.)' file.txt
# Matches "fa" followed by "ob", etc.

{n} — exactly n

$ grep -E 'o{2}' words.txt
food
moon
# Matches exactly two o's in a row

{n,m} — between n and m

$ grep -E 'o{1,3}' words.txt
dog      # 1 o
food     # 2 o's
fooood   # 4 o's — still matches the first 3? No: pattern is 1-3, "oooo" = 4

? — zero or one

$ grep -E 'fo?d' words.txt
fd
fod
# Matches f, optional o, d
# Does NOT match "food" (that's 2 o's)

+ — one or more

$ grep -E 'fo+d' words.txt
fod
food
fooood
# Matches f, 1+ o's, d
# Does NOT match "fd"

| — alternation

$ grep -E 'foo|bar' file.txt
foo
bar
foobar
# Matches lines containing "foo" OR "bar"

BRE vs ERE — the key differences:

Feature	BRE	ERE
`+`	literal `+`	one or more
`?`	literal `?`	zero or one
`\|`	literal `\|`	alternation
`( )`	literal	grouping
`{ }`	literal	repetition
`*`	zero or more	zero or more
`.`	any char	any char
`^ $`	anchors	anchors

In BRE, you escape these to get their special meaning: \+, \?, \|, $, $, \{, \}. In ERE, you use them bare and escape them to make them literal.

c – regular expressions and POSIX character classes

POSIX character classes are portable, readable alternatives to explicit ranges. Write them inside [ ] — e.g., [ [ :digit: ] ].

Class	Matches	Equivalent
`[ :alnum: ]`	Letters and digits	`[ A-Za-z0-9 ]`
`[ :alpha: ]`	Letters only	`[ A-Za-z ]`
`[ :digit: ]`	Digits	`[ 0-9 ]`
`[ :lower: ]`	Lowercase letters	`[ a-z ]`
`[ :upper: ]`	Uppercase letters	`[ A-Z ]`
`[ :blank: ]`	Space or tab	`[ \t ]`
`[ :space: ]`	Any whitespace	`[ \t\n\r\f\v ]`
`[ :graph: ]`	Printable, non-space	—
`[ :print: ]`	Printable incl. space	—
`[ :punct: ]`	Punctuation	`[ !@#$%^&*... ]`
`[ :xdigit: ]`	Hex digits	`[ 0-9A-Fa-f ]`

Examples:

# Any digit
$ grep '[[:digit: ] ]' file.txt

# Any two digits in a row
$ grep -E '[[:digit: ] ][[:digit: ] ]' file.txt

# Starts with uppercase
$ grep '^[[:upper: ] ]' file.txt

# Contains punctuation
$ grep '[[:punct: ] ]' file.txt

# Whitespace at the end
$ grep '[[:space: ] ]$' file.txt

# Shell globbing with classes
$ ls /home/kr/cli/[[:upper: ] ]*
# Lists files starting with an uppercase letter

$ ls /home/kr/cli/[[:digit: ] ]*
# Lists files starting with a digit

Tip: POSIX classes are locale-aware. On a UTF-8 system, [ [ :alpha: ] ] matches accented letters too. Explicit ranges like [ A-Za-z ] don’t. Use classes when portability matters.

d – regular expressions examples

Here are the examples from the top of the chapter, explained line by line.

1. Find lines containing two consecutive digits:

$ grep -E '[0-9 ][0-9 ]' numbers.txt
42 apples
call 555-1234
version 10.5

The pattern [ 0-9 ][ 0-9 ] matches any two digits in a row. Lines with a single digit (7) or non-consecutive digits (1 2) don’t match.

2. Find lines that start with a vowel:

$ grep -E '^[aeiouAEIOU ]' vowels.txt
apple
orange
Eagle
umbrella

^ anchors to the start; [ aeiouAEIOU ] matches any vowel, upper or lower. Lines starting with consonants don’t match.

3. Replace “food” with “bard” (using backreferences):

$ sed -E 's/f([a-z ])o\1d/b&r/' input.txt > output.txt

Let’s break this down:

f — literal f
([ a-z ]) — group 1: any lowercase letter
o — literal o
\1 — backreference to group 1 (the same letter again)
d — literal d
b&r — replacement: b, then the whole match (&), then r

So food → group 1 = o, match = food, replacement = bfoodr. Wait — that’s bfoodr? Let me re-check.

Actually the replacement b&r inserts a b before the match and an r after, giving bfoodr. To replace with “bard” you’d write s/f([ a-z ])o\1d/b\1rd/ or similar. The example as written wraps the match with b and r. The point is to demonstrate capture groups and backreferences.

4. Print lines that start with a number AND contain the letter “a”:

$ awk '/^[0-9 ]/ && /a/' data.txt
3 apples
42 bananas
7 and 8

awk evaluates /^[ 0-9 ]/ (starts with a digit) and /a/ (contains an “a”). Both must be true for the line to print.

5. Same replacement with awk’s gsub:

$ awk '{gsub(/f([a-z ])o\1d/, "b&r"); print}' input.txt > output.txt

gsub(/pattern/, "replacement") — global substitution
& in the replacement means “the whole match”
Same regex and backreference as the sed example, but done in awk for every line

6. Find lines containing the literal string .com:

$ grep -E '\.com' domains.txt
example.com
google.com
notacom

The \. escapes the dot so it matches a literal dot, not “any character.” Without the backslash, grep -E '.com' would also match xcom, 1com, etc.

7. List files starting with an uppercase letter:

$ ls /home/kr/cli/[[:upper: ] ]*
README.md
Notes.txt

POSIX class in a shell glob — note this is the shell’s own pattern matching, not grep. The shell supports a subset of POSIX classes.

8. List files starting with a digit:

$ ls /home/kr/cli/[[:digit: ] ]*
1.txt
2-notes.md
3rd-draft.docx

Complete Example Session

# ============================================
# PART 1: BASIC METACHARACTERS
# ============================================

$ cat words.txt
food
fard
feed
foot
fd
fod
fed

# . → any character
$ grep 'f..d' words.txt
food
fard
feed
# (foot is 4 chars, won't match)

# ^ → start of line
$ grep '^foo' words.txt
food
foot

# $ → end of line
$ grep 'ood$' words.txt
food
# (foot ends in "oot", not "ood")

# * → zero or more
$ grep 'fo*d' words.txt
food
fd
fod
# (fed doesn't match — the middle must be o or nothing)

# [  ] → character class
$ grep '[aeiou ]' words.txt
food
fard
feed
...

# ============================================
# PART 2: EXTENDED METACHARACTERS
# ============================================

# + → one or more
$ grep -E 'fo+d' words.txt
food
fod
# (fd doesn't match; food and fod do)

# ? → zero or one
$ grep -E 'fo?d' words.txt
fd
fod
# (food has 2 o's — doesn't match)

# {n} → exactly n
$ grep -E 'o{2}' words.txt
food
# (only "food" has exactly two o's in a row)

# | → alternation
$ grep -E 'food|fod' words.txt
food
fod

# ( ) → grouping
$ grep -E '(foo|far)d' words.txt
food
fard

# ============================================
# PART 3: POSIX CLASSES
# ============================================

$ cat mixed.txt
abc123
Hello
!@#$
42
   spaces

$ grep '[[:digit: ] ]' mixed.txt
abc123
42

$ grep '[[:upper: ] ]' mixed.txt
Hello

$ grep '[[:punct: ] ]' mixed.txt
!@#$

$ grep '[[:space: ] ]' mixed.txt
   spaces

# ============================================
# PART 4: BACKREFERENCES
# ============================================

$ cat input.txt
food is good
fad is bad
feed the fed

# Match f, any lowercase letter, o, SAME letter, d
$ grep -E 'f([a-z ])o\1d' input.txt
food is good

# The \1 refers back to what ([a-z ]) matched
# "food" → group 1 = "o", pattern = f o o d ✅
# "fad"  → group 1 = "a", pattern = f a o a d ❌ (doesn't match)

# ============================================
# PART 5: SED WITH BACKREFERENCES
# ============================================

$ sed -E 's/f([a-z ])o\1d/b&r/' input.txt > output.txt
$ cat output.txt
bfoodr is good
fad is bad
feed the fed

# Only "food" matched the pattern
# The replacement wrapped it with b and r

# ============================================
# PART 6: AWK
# ============================================

$ cat data.txt
3 apples
42 bananas
7 and 8
banana
99 problems

# Lines starting with a digit AND containing 'a'
$ awk '/^[0-9 ]/ && /a/' data.txt
3 apples
42 bananas
7 and 8

# Global substitution
$ awk '{gsub(/f([a-z ])o\1d/, "b&r"); print}' input.txt
bfoodr is good
fad is bad
feed the fed

# ============================================
# PART 7: ESCAPING
# ============================================

$ cat domains.txt
example.com
google.com
notacom
xcom

# Literal dot
$ grep -E '\.com' domains.txt
example.com
google.com
# (notacom and xcom don't have a literal dot)

# Without escaping — matches any char before "com"
$ grep -E '.com' domains.txt
example.com
google.com
notacom
xcom
# (all match because . matches any character)

# ============================================
# PART 8: SHELL GLOBBING WITH CLASSES
# ============================================

$ ls /home/kr/cli/
README.md  Notes.txt  1.txt  2-notes.md  script.sh

$ ls /home/kr/cli/[[:upper: ] ]*
README.md  Notes.txt

$ ls /home/kr/cli/[[:digit: ] ]*
1.txt  2-notes.md

Quick Reference

Basic Metacharacters (BRE)

Meta	Meaning
`.`	Any single character
`^`	Start of line
`$`	End of line
`[ ]`	Character class
`[ ^ ]`	Negated class
`*`	Zero or more
`\`	Escape

Extended Metacharacters (ERE)

Meta	Meaning
`( )`	Grouping
`{n}`	Exactly n
`{n,m}`	Between n and m
`?`	Zero or one
`+`	One or more
`\|`	Alternation

POSIX Classes

Class	Matches
`[ :alnum: ]`	Letters + digits
`[ :alpha: ]`	Letters
`[ :digit: ]`	Digits
`[ :lower: ]`	Lowercase
`[ :upper: ]`	Uppercase
`[ :blank: ]`	Space or tab
`[ :space: ]`	Any whitespace
`[ :graph: ]`	Printable, non-space
`[ :print: ]`	Printable
`[ :punct: ]`	Punctuation
`[ :xdigit: ]`	Hex digits

Anchors and Quantifiers

Pattern	Meaning
`^foo`	Starts with foo
`foo$`	Ends with foo
`^foo$`	Exactly “foo”
`fo*`	f + 0+ o’s
`fo+`	f + 1+ o’s
`fo?`	f + 0 or 1 o
`fo{2}`	f + exactly 2 o’s
`fo{2,4}`	f + 2–4 o’s

Backreferences

Pattern	Meaning
`(abc)\1`	“abc” repeated twice
`f([ a-z ])o\1d`	f, letter, o, SAME letter, d
`&` (in sed/awk)	The entire match
`\1`, `\2`, …	Group 1, group 2, …

BRE vs ERE

Operator	BRE	ERE
`+`	`\+`	`+`
`?`	`\?`	`?`
`\|`	`\|`	`
`( )`	``	`( )`
`{ }`	`\{ \}`	`{ }`

Tool Dialects

Tool	Default	ERE flag
`grep`	BRE	`-E`
`sed`	BRE	`-E`
`awk`	ERE	(default)
Shell glob	POSIX subset	—

Best Practices

✅ Do This:

# Use -E for extended regex in grep and sed
grep -E 'foo|bar' file.txt             # ✅

# Escape dots in literal matches
grep -E '\.com' file.txt               # ✅

# Anchor patterns to avoid over-matching
grep -E '^foo$' file.txt               # ✅

# Use POSIX classes for portability
grep '[[:digit: ] ]' file.txt            # ✅

# Test patterns on a small sample first
echo "test" | grep -E 'pattern'        # ✅

# Use backreferences for repeated patterns
sed -E 's/(foo)\1/bar/' file.txt       # ✅

# Quote patterns in the shell
grep '^foo' file.txt                   # ✅

❌ Don’t Do This:

# Don't forget -E for ERE operators
grep 'foo|bar' file.txt                # ❌ literal | in BRE

# Don't use unescaped dots for literal dots
grep '.com' file.txt                   # ❌ matches any char

# Don't forget to anchor
grep 'foo' file.txt                    # ⚠️  matches anywhere

# Don't assume BRE and ERE are the same
sed 's/(foo)/bar/' file.txt            # ❌ literal parens in BRE

# Don't use regex on huge files casually
grep -E '.*.*.*' hugefile              # ❌ catastrophic backtracking

# Don't forget to quote special chars in shell
grep ^foo file.txt                     # ❌ shell may interpret

# Don't mix dialects
grep -E 'foo\{2\}' file.txt            # ❌ escaping wrong for ERE

Common Pitfalls

Pitfall	Problem	Solution
Forgot `-E`	`+`, `?`, `\|` are literal	Add `-E`
Unescaped `.`	Matches any char	Escape it: `\.`
No anchors	Over-matches	Use `^` and `$`
Wrong dialect	Pattern fails	Check BRE vs ERE
Greedy `.*`	Matches too much	Use `[ ^" ]*` or non-greedy tools
Backreference confusion	Wrong group	Count `(` left to right
Locale issues	`[ A-Z ]` matches weird chars	Use POSIX classes
Unquoted pattern	Shell expands it	Quote with `'...'`
Catastrophic backtracking	Slow on big files	Simplify the pattern
Escaping in shell	Double escaping	Use single quotes

Real-World Examples

1. Find Email Addresses

$ grep -E '[[:alnum: ]._%+- ]+@[[:alnum: ].- ]+\.[[:alpha: ] ]{2,}' emails.txt
alice@example.com
bob.smith@company.org

2. Find IPv4 Addresses

$ grep -E '([0-9 ]{1,3}\.){3}[0-9 ]{1,3}' logs.txt
192.168.1.100
10.0.0.1

3. Find Lines That Start with a Digit

$ grep -E '^[0-9 ]' data.txt
3 apples
42 bananas

4. Find Blank Lines

$ grep -E '^$' file.txt
# (prints only empty lines)

5. Remove Trailing Whitespace

$ sed -E 's/[[:space: ] ]+$//' file.txt > clean.txt

6. Extract the First Word of Each Line

$ awk '{print $1}' file.txt

7. Swap Two Fields

$ sed -E 's/^([^  ]+) ([^  ]+)/\2 \1/' file.txt
# "hello world" → "world hello"

8. Replace Repeated Words

$ sed -E 's/\b([a-z ]+) \1\b/\1/' file.txt
# "the the cat" → "the cat"

9. Validate a Simple Date

$ grep -E '^[0-9 ]{4}-[0-9 ]{2}-[0-9 ]{2}$' dates.txt
2024-01-15
2023-12-31

10. Find Files Modified by a User

$ find . -user kronos -name '*.log' -mtime -7

11. Match Comments in a Config File

$ grep -E '^[[:space: ] ]*#' sshd_config
# Lines that begin with optional whitespace, then #

12. Strip HTML Tags

$ sed -E 's/<[^> ]+>//g' page.html

13. Extract Version Numbers

$ grep -E 'v?[0-9 ]+\.[0-9 ]+\.[0-9 ]+' versions.txt
v1.2.3
2.0.1

14. Find Duplicate Lines

$ sort file.txt | uniq -d

15. Filter Log Lines by Severity

$ grep -E 'ERROR|WARN' app.log
2024-01-15 10:30:00 ERROR: connection refused
2024-01-15 10:35:00 WARN: disk almost full

Visual: Regex Cheat Sheet

┌──────────────────────────────────────────────┐
│              ANCHORS                         │
│  ^     start of line                         │
│  $     end of line                           │
│                                              │
│              CHARACTERS                      │
│  .     any single char                       │
│  [  ]   character class                       │
│  [^  ]  negated class                         │
│  \d    digit (PCRE)                          │
│  \w    word char (PCRE)                      │
│  \s    whitespace (PCRE)                     │
│                                              │
│              QUANTIFIERS                     │
│  *     0 or more                             │
│  +     1 or more                             │
│  ?     0 or 1                                │
│  {n}   exactly n                             │
│  {n,m} between n and m                       │
│                                              │
│              GROUPING                        │
│  ( )   group                                 │
│  |     alternation                           │
│  \1    backreference to group 1              │
│                                              │
│              CLASSES                         │
│  [[:digit: ] ]   digits                        │
│  [[:alpha: ] ]   letters                       │
│  [[:upper: ] ]   uppercase                     │
│  [[:lower: ] ]   lowercase                     │
│  [[:space: ] ]   whitespace                    │
│  [[:punct: ] ]   punctuation                   │
│  [[:xdigit: ] ]  hex digits                    │
└──────────────────────────────────────────────┘

Summary

Pattern	Meaning	Example
`.`	Any character	`f..d` → food, fard
`^`	Start of line	`^foo` → foobar
`$`	End of line	`bar$` → foobar
`[ abc ]`	Any of a, b, c	`[ aeiou ]` → vowels
`[ ^abc ]`	Not a, b, c	`[ ^0-9 ]` → non-digits
`*`	0 or more	`fo*d` → fd, food
`+`	1 or more	`fo+d` → food, fod
`?`	0 or 1	`fo?d` → fd, fod
`{n}`	Exactly n	`o{2}` → oo
`{n,m}`	n to m	`o{1,3}` → o, oo, ooo
`\|`	OR	`foo\|bar`
`( )`	Group	`(foo)bar` → foobar
`\1`	Backreference	`(f.)(o.)`
`\.`	Literal dot	`\.com`
`[ [ :digit: ] ]`	Digit	`[ [ :digit: ] ]+`
`[ [ :alpha: ] ]`	Letter	`[ [ :alpha: ] ]+`
`[ [ :upper: ] ]`	Uppercase	`^[ [ :upper: ] ]`
`[ [ :space: ] ]`	Whitespace	`[ [ :space: ] ]+`

Key takeaways:

Regex is pattern matching — literal characters plus metacharacters
BRE (basic) is the default for grep and sed; ERE (extended) needs -E
awk uses ERE by default
. matches any char, ^ and $ anchor, [ ] is a class, [ ^ ] negates
* = 0+, + = 1+, ? = 0/1, {n,m} = range
( ) groups, \1 refers back to a group, | means OR
Escape special characters with \ — especially . when you want a literal dot
POSIX classes ([ [ :digit: ] ], [ [ :alpha: ] ], etc.) are portable and locale-aware
Test patterns on a small sample before running on a big file
Quote patterns in the shell — use single quotes to avoid expansion
Regex can be slow on large files — keep patterns simple

Remember: Regex is a language, and like any language it takes practice. Start with the basics — ., ^, $, [ ], * — then add ERE operators as needed. Always ask: which dialect am I in? grep and sed are BRE by default; add -E for the full power. Use [ [ :digit: ] ] instead of [ 0-9 ] when portability matters. Escape your dots. Anchor your patterns. And always test on a small sample before unleashing a regex on a million-line log file.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!