3.2grep -- Search Logs and Files

grep searches for patterns in files and outputs matching lines. It is your first tool when investigating failures in log files.

Basic Usage

# Find ERROR lines in a log file
grep "ERROR" /var/log/app/application.log

# Case-insensitive search
grep -i "null pointer" /var/log/app/application.log

# Show 3 lines of context around each match (Before and After)
grep -C 3 "ERROR" /var/log/app/application.log

# Show only 3 lines before the match
grep -B 3 "ERROR" /var/log/app/application.log

# Show only 3 lines after the match
grep -A 3 "ERROR" /var/log/app/application.log

Searching Across Files

# Recursive search in all test files
grep -r "data-testid=\"checkout" tests/

# Recursive search with file name display
grep -rn "data-testid=\"checkout" tests/
# tests/checkout.spec.ts:15:  await page.locator('[data-testid="checkout"]').click()

# Search only specific file types
grep -r --include="*.ts" "waitForTimeout" tests/

# Exclude directories from search
grep -r --exclude-dir=node_modules "TODO" .

Counting and Filtering

# Count matching lines
grep -c "ERROR" /var/log/app/application.log
# Output: 47

# Count 500 errors in nginx logs
grep "HTTP 500" /var/log/nginx/access.log | wc -l

# Show only the matching part of the line (not the whole line)
grep -o "HTTP [0-9]\{3\}" /var/log/nginx/access.log | sort | uniq -c | sort -rn
# Output:
#   12847 HTTP 200
#     234 HTTP 404
#      47 HTTP 500
#      12 HTTP 503

# Invert match: show lines that do NOT match
grep -v "healthcheck" /var/log/app/application.log
# Exclude noisy health check lines from log analysis

# Multiple patterns (OR logic)
grep -E "ERROR|FATAL|CRITICAL" /var/log/app/application.log

Regular Expressions with grep

# Match lines with timestamps in a specific range
grep -E "2024-01-15 14:3[0-9]:" /var/log/app/application.log

# Match email addresses
grep -oE "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" users.txt

# Match IP addresses
grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" access.log