How to Search for Multiple Patterns with `grep`.

When searching logs, source code, or configuration files, you can use one grep command for several search terms instead of running separate searches.

Match any of several patterns

Use grep -E to write alternatives with the | operator:

$ grep -E 'error|fail' app.log

This prints lines containing either error or fail. By default, matches are case-sensitive and can occur inside longer words—for example, fail also matches failed.

For whole-word matches, add -w:

$ grep -wE 'error|fail' app.log

For case-insensitive whole-word matching:

$ grep -iwE 'error|fail' app.log

Use multiple -e options

You can provide patterns separately with -e. This is useful when patterns are complex or begin with a hyphen:

$ grep -e 'error' -e 'fail' app.log

Each pattern is an alternative: a line is printed if it matches at least one of them.

Match literal strings, not regular expressions

Regular expressions treat characters such as ., *, and [ as special syntax. If you want to search for literal text, use -F:

$ grep -F -e 'connection refused' -e 'disk full' app.log

This searches for either exact phrase as plain text.

You can also store many literal patterns in a file, one per line:

connection refused
disk full
permission denied

Save it as patterns.txt, then run:

$ grep -F -f patterns.txt app.log

Match lines containing both terms

The | operator means “either pattern,” not “both.” To find a line containing both error and fail, in either order, use:

$ grep -E 'error.*fail|fail.*error' app.log

Here, .* matches any characters between the two terms. Both terms must be on the same line for this pattern to match.

Search several files

To search all .log files in the current directory:

$ grep -E 'error|fail' ./*.log

The shell expands ./*.log to matching files in the current directory; it does not include subdirectories.

To search recursively under a directory and include only .conf files with GNU grep:

$ grep -rE --include='*.conf' 'listen|server_name' /etc/nginx/

The -r option searches subdirectories. --include limits the search to files whose names match the given pattern.

Make results easier to scan

Show line numbers and colorize matching text:

$ grep -n --color=auto -E 'warning|notice|info' system.log

When searching multiple files, grep normally includes filenames. To force filenames even when searching one file, add -H:

$ grep -nH --color=auto -E 'warning|notice|info' system.log

Count matching lines or occurrences

Use -c to count matching lines. A line matching more than one pattern is still counted once:

$ grep -c -E 'error|fail' app.log

On GNU/Linux, use -o to print each matched occurrence separately, then count those output lines:

$ grep -oiwE 'yes|no|maybe' poll-results.txt | wc -l

This counts whole-word occurrences, not lines. Without -w, substrings inside longer words may also be counted.

Which option should you use?

• Use -E for readable regular expressions and alternatives such as error|fail.
• Use -e to provide separate patterns.
• Use -F for literal strings, especially when searching phrases containing punctuation.
• Use -f to load patterns from a file.
• Use -i for case-insensitive matching.

Prefer grep -E over the older egrep command name. GNU grep documents egrep as obsolete; grep -E expresses the same extended-regular-expression mode.

For most searches across several terms, grep -E 'one|two|three' file is the simplest approach. Use -F when the terms are literal text, and remember that alternatives match any listed pattern. When you need every term on a line, write a pattern that explicitly requires them all.

We hope this was helpful.
Keep learning. Keep exploring. Stay secure.