Capture Groups

Extract value from key=value pair

cat <<'EOF' > /tmp/app.conf
database_host=10.50.1.50
database_port=5432
database_name=domus
log_level=debug
EOF
sed -n 's/^database_host=\(.*\)/\1/p' /tmp/app.conf

Extract IP addresses from log lines

cat <<'EOF' > /tmp/auth.log
Apr 11 08:14:22 modestus-aw sshd[1234]: Accepted publickey for evan from 10.50.1.100 port 52341
Apr 11 08:14:23 modestus-aw sshd[1235]: Failed password for root from 192.168.1.50 port 52342
Apr 11 08:15:01 modestus-aw sshd[1236]: Accepted publickey for evan from 10.50.1.20 port 52343
EOF
sed -n 's/.*from \([0-9.]*\) port.*/\1/p' /tmp/auth.log

Extract hostnames from SSH config

cat <<'EOF' > /tmp/ssh_config
Host ise-01
    HostName ise-01.inside.domusdigitalis.dev
Host ad-dc
    HostName ad-dc.inside.domusdigitalis.dev
Host pfsense
    HostName 10.50.1.1
EOF
sed -n 's/^Host \([^ ]*\)/\1/p' /tmp/ssh_config

Strip YAML key — extract value after colon

cat <<'EOF' > /tmp/config.yml
name: domus-captures
version: 1.0.0
prerelease: false
title: Captures
EOF
sed -n 's/^version: *\(.*\)/\1/p' /tmp/config.yml

Extract text between delimiters — square brackets

cat <<'EOF' > /tmp/log.txt
[INFO] Server started on port 443
[ERROR] Connection refused to 10.50.1.50
[WARN] Certificate expires in 7 days
[ERROR] Authentication failed for user admin
EOF
sed -n 's/^\[\([^]]*\)\].*/\1/p' /tmp/log.txt

Extract URLs from HTML

cat <<'EOF' > /tmp/links.html
<a href="https://docs.domusdigitalis.dev">Documentation</a>
<a href="https://github.com/domus/captures">Repository</a>
<a href="https://vault.inside.domusdigitalis.dev">Vault</a>
EOF
sed -n 's/.*href="\([^"]*\)".*/\1/p' /tmp/links.html

Extract Antora component name from antora.yml

cat <<'EOF' > /tmp/antora.yml
name: captures
title: Captures
version: ~
nav:
  - modules/ROOT/nav.adoc
EOF
sed -n 's/^name: *\(.*\)/\1/p' /tmp/antora.yml

Extract multiple capture groups — reformat date

echo '2026-04-11' | sed 's/\([0-9]\{4\}\)-\([0-9]\{2\}\)-\([0-9]\{2\}\)/\3\/\2\/\1/'

Extract with ERE — cleaner capture group syntax

cat <<'EOF' > /tmp/auth.log
Apr 11 08:14:22 sshd[1234]: Accepted publickey for evan from 10.50.1.100
Apr 11 08:14:23 sshd[1235]: Failed password for root from 192.168.1.50
EOF
sed -En 's/.*for ([^ ]+) from ([0-9.]+)/user=\1 ip=\2/p' /tmp/auth.log