Regular Expressions (Regex) — Pattern Matching in Linux¶

Regular Expressions (Regex) are a powerful pattern-matching language used to search, filter, validate, and manipulate text. They are the foundation of commands like grep, sed, and awk, and are widely used in programming languages, log analysis, DevOps automation, cybersecurity, and system administration.

Learning Path¶

Linux Mastery → Module 3: Text Processing → Lesson 18

Difficulty: Intermediate → Advanced

Reading Time: 75 Minutes

Course Progress

Course: Linux Mastery

Module: Text Processing

Lesson: 18 of 18

What You'll Learn¶

After completing this lesson, you'll be able to:

Understand Regular Expressions
Match exact text
Use anchors
Work with wildcards
Create character classes
Use quantifiers
Apply grouping
Build advanced search patterns
Use Regex with grep, sed, awk, and find
Analyze production logs

Prerequisites¶

Complete:

Module 1
Module 2
Module 3 Lessons 1–17

Why Learn Regex?¶

Suppose a production log contains 10 million lines.

You need to find:

IP addresses
Email addresses
URLs
Failed login attempts
Error codes
Kubernetes Pod names
Docker image tags

Without Regex:

Impossible.

With Regex:

grep -E

Done in seconds.

What is a Regular Expression?¶

A Regular Expression (Regex) is a pattern used to match text.

Instead of searching for one word:

ERROR

Regex lets you search for patterns such as:

Any IP address

Any email

Any number

Any uppercase word

Any date

Sample File¶

Create:

cat > sample.txt

Contents:

Alice

Bob

Charlie123

admin@example.com

10.0.0.5

ERROR

WARNING

Linux

Ubuntu

Docker123

Exact Match¶

grep "ERROR" sample.txt

Matches:

ERROR

Dot (.)¶

Matches any single character.

Pattern:

L.nux

Matches:

Linux

Also matches:

L1nux

L-nux

Beginning of Line (^)¶

grep "^Alice"

Matches:

Alice

End of Line ($)¶

grep "ERROR$"

Matches only lines ending with:

ERROR

Character Classes¶

Any digit.

[0-9]

Lowercase.

[a-z]

Uppercase.

[A-Z]

Letters.

[A-Za-z]

Letters and digits.

[A-Za-z0-9]

Negated Character Class¶

Anything except digits.

[^0-9]

Wildcard *¶

Zero or more.

ab*

Matches:

a

ab

abb

abbbb

Plus (+)¶

One or more.

ab+

Matches:

ab

abb

abbbbb

Requires:

-E

Question Mark (?)¶

Optional.

colou?r

Matches:

color

colour

Curly Braces {}¶

Exactly three digits.

[0-9]{3}

Between 2 and 5.

[0-9]{2,5}

OR Operator¶

ERROR|WARNING

grep -E

Grouping¶

(dev|prod)

Matches:

dev

prod

Word Boundary¶

\<Linux\>

Matches:

Linux

Not:

LinuxServer

Common POSIX Character Classes¶

Pattern	Meaning
`[[:digit:]]`	Digits
`[[:alpha:]]`	Letters
`[[:alnum:]]`	Letters and digits
`[[:space:]]`	Whitespace
`[[:upper:]]`	Uppercase
`[[:lower:]]`	Lowercase

Search Numbers¶

grep "[0-9]"

Search Uppercase¶

grep "[A-Z]"

Search Emails¶

[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}

Example:

grep -E

Search IPv4 Addresses¶

([0-9]{1,3}\.){3}[0-9]{1,3}

Search URLs¶

https?://

Search Kubernetes Pods¶

pod-.*

Search Docker Images¶

nginx:[0-9.]

Regex with grep¶

grep -E "ERROR|WARNING"

Regex with sed¶

Replace all digits.

sed 's/[0-9]/X/g'

Regex with awk¶

awk '$2~/Engineering/'

Regex with find¶

find . -regex ".*\.log"

Production Examples¶

Failed SSH login.

grep "Failed password"

IP addresses.

grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}"

Emails.

grep -E "[A-Za-z0-9._%+-]+@"

Container image.

grep -E "image:"

YAML values.

grep -E "^image:"

Production Perspective¶

Regex is used in:

Linux
Kubernetes
Docker
Git
GitLab
Jenkins
Terraform
Ansible
Python
Java
Go
Security
SIEM
Splunk

Learning Regex once benefits almost every technology you use.

Hands-on Lab¶

Task 1¶

Search uppercase.

grep "[A-Z]" sample.txt

Task 2¶

Search numbers.

grep "[0-9]" sample.txt

Task 3¶

Search email.

grep -E "[A-Za-z0-9._%+-]+@"

Task 4¶

Search IP.

grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}"

Task 5¶

Replace digits.

sed 's/[0-9]/X/g'

Task 6¶

Engineering.

awk '$2~/Engineering/'

Task 7¶

Search URLs.

grep -E "https?://"

Task 8¶

Beginning and end.

grep "^ERROR$"

Regex Cheat Sheet¶

Symbol	Meaning
`.`	Any character
`^`	Beginning of line
`$`	End of line
`*`	Zero or more
`+`	One or more
`?`	Optional
`[]`	Character class
`[^]`	Negated class
`{}`	Repetition
`\|`	OR
`()`	Group

Production Troubleshooting Scenario¶

Scenario

An SRE receives a 5 GB application log.

Tasks:

Find ERROR and WARNING messages.
Extract IP addresses.
Extract email addresses.
Find Kubernetes image tags.
Count failed logins.

Commands:

grep -E "ERROR|WARNING"

grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}"

grep -E "[A-Za-z0-9._%+-]+@"

grep "^image:"

grep "Failed password" | wc -l

Best Practices¶

Use grep -E for extended regular expressions.
Test Regex on sample files before production use.
Keep patterns readable and well-documented.
Avoid overly broad patterns that may produce false positives.
Build complex expressions incrementally.

Common Mistakes¶

❌ Confusing shell wildcards (*, ?) with Regex.

✅ Shell globbing and Regex are different.

❌ Forgetting -E.

✅ Patterns using:

+

?

|

{}

generally require:

grep -E

❌ Creating patterns that are too greedy.

✅ Use the simplest pattern that matches the intended data.

Interview Questions¶

Beginner¶

What is a Regular Expression?
What does . match?
What does ^ represent?
What does $ represent?

Intermediate¶

Difference between * and +.
Explain character classes.
What is grep -E?
How do you match an email address?

Architect Level¶

How would you analyze a multi-gigabyte production log using Regex?
Why are Regular Expressions essential in DevOps automation?
How do you balance Regex flexibility with readability and maintainability?

Summary¶

In this lesson, you learned:

Regex fundamentals
Anchors
Character classes
Quantifiers
Grouping
Alternation
Pattern matching
Real-world production examples

Regular Expressions are one of the most valuable skills in Linux and software engineering. Once mastered, they become a powerful tool for searching, validating, extracting, and transforming data across countless technologies.

Key Takeaways¶

Regex matches patterns, not just literal text.
Learn anchors (^, $) and character classes ([]) early.
Use grep -E for extended Regex features.
Regex is used throughout Linux, DevOps, cloud platforms, and programming languages.
Practice regularly—the best way to master Regex is by solving real-world text-processing problems.

Module 3 Completed!¶

Congratulations! You have mastered Linux text processing, including:

grep
cut
sort
uniq
tr
wc
paste
join
split
fmt
column
strings
tee
xargs
sed
awk
Regular Expressions (Regex)

You are now equipped with the core text-processing skills used daily by Linux Administrators, DevOps Engineers, SREs, Cloud Architects, and Security Professionals.

Next Module¶

Module 4 – File Management and Permissions

Start with File Types in Linux, then continue with links, permissions, ownership, umask, ACLs, and secure file operations.