grep Pattern Matching

Pattern matching with grep - regular expressions, context, and file filtering.

Core Patterns

Basic Search

Lines containing pattern
grep 'pattern' file
Lines NOT containing pattern
grep -v 'pattern' file
Count matching lines
grep -c 'pattern' file
Show line numbers
grep -n 'pattern' file
Case insensitive
grep -i 'error' file
Whole word only
grep -w 'error' file
Files containing pattern
grep -l 'pattern' *.txt
Files NOT containing pattern
grep -L 'pattern' *.txt

Recursive Search

Recursive with line numbers
grep -rn 'pattern' /path
Recursive, filenames only
grep -rl 'pattern' /path
Exclude directories
grep -r --exclude-dir='.git' 'pattern' .
Include only specific extensions
grep -rn --include='*.adoc' 'pattern' docs/

Context Lines

3 lines AFTER match
grep -A3 'pattern' file
3 lines BEFORE match
grep -B3 'pattern' file
3 lines BEFORE and AFTER
grep -C3 'pattern' file
Extract only matching part
grep -o 'pattern' file

Multiple Patterns

OR with -e flags
grep -e 'pat1' -e 'pat2' file
OR with ERE
grep -E 'error|warn|fatal' file
OR with BRE (escaped)
grep 'error\|warn' file

Regex Types

BRE - Basic (default)
grep 'go\+d' file
ERE - Extended
grep -E 'go+d' file
PCRE - Perl Compatible
grep -P '\d+' file

Anchors

Lines starting with pattern
grep '^#' file
Lines ending with pattern
grep 'end$' file
Empty lines
grep '^$' file
Non-empty lines
grep -v '^$' file
Lines NOT starting with #
grep '^[^#]' file

Character Classes

Any digit
grep '[0-9]' file
Any letter
grep '[a-zA-Z]' file
POSIX digit class
grep '[[:digit:]]' file
POSIX alphanumeric
grep '[[:alnum:]]' file
PCRE digit shortcut
grep -P '\d' file
PCRE word character
grep -P '\w' file

Quantifiers

Zero or more (BRE)
grep 'go*d' file
One or more (ERE)
grep -E 'go+d' file
Zero or one (ERE)
grep -E 'go?d' file
Exactly N times (ERE)
grep -E 'go{2}d' file
N to M times (ERE)
grep -E 'go{2,4}d' file

Groups and Backreferences

Grouping with alternation
grep -E 'gr(a|e)y' file
Repeated group
grep -E '(ab)+' file
Backreference - repeated character
grep -E '(.)\1' file

Output Control

Only matching part
grep -o 'pattern' file
No filename prefix
grep -h 'pattern' files
Force filename prefix
grep -H 'pattern' file
Stop after N matches
grep -m5 'pattern' file
Quiet mode for scripts
grep -q 'pattern' file && echo "found"
Force color output
grep --color=always 'pattern' file

Fixed Strings (Faster)

Literal string, no regex
grep -F 'literal.string' file
Match patterns from file
grep -F -f patterns.txt file

Scripting

Check if pattern exists
grep -q 'pattern' file && echo "found" || echo "not found"
Count and compare
count=$(grep -c 'ERROR' log); [[ $count -gt 10 ]] && echo "Too many: $count"
Process matching files
grep -l 'pattern' *.py | while read f; do echo "Found in: $f"; done

AsciiDoc Patterns

Headers

Document title (Level 1)
grep -n '^= ' file.adoc
Level 2 headers
grep -n '^== ' file.adoc
Level 3 headers
grep -n '^=== ' file.adoc
All headers (outline)
grep -nE '^={1,5} ' file.adoc
Headers containing keyword
grep -n '^={2,4}.*deploy' docs/**/*.adoc

Attributes

Document attributes
grep -nE '^:[a-z]' file.adoc
Antora attributes (4-space indent)
grep -E '^    [a-z]' antora.yml
Attribute usage in file
grep -n '{[a-z][a-z0-9-]*}' file.adoc
Extract unique attributes used
grep -oE '\{[a-z][a-z0-9-]*\}' file.adoc | sort -u
Escaped attributes
grep -n '\\{' file.adoc

Includes

All includes
grep -n 'include::' file.adoc
Partial includes
grep -n 'include::partial\$' file.adoc
Example includes
grep -n 'include::example\$' file.adoc
Cross-component includes
grep -n 'include::[a-z-]*::' file.adoc

Cross-References

All xrefs
grep -n 'xref:' file.adoc
Same-component xrefs
grep -nE 'xref:[^:]+\.adoc' file.adoc
Cross-component xrefs
grep -nE 'xref:[a-z-]+::' file.adoc
Xrefs with anchors
grep -n 'xref:.*#' file.adoc
External links
grep -nE 'https?://' file.adoc

Source Blocks

All source blocks
grep -n '\[source,' file.adoc
Bash source blocks
grep -n '\[source,bash' file.adoc
YAML source blocks
grep -n '\[source,yaml' file.adoc
Blocks with attribute substitution
grep -n 'subs=attributes' file.adoc

Admonitions

NOTE blocks
grep -n '^NOTE:' file.adoc
TIP blocks
grep -n '^TIP:' file.adoc
WARNING blocks
grep -n '^WARNING:' file.adoc
IMPORTANT blocks
grep -n '^IMPORTANT:' file.adoc
CAUTION blocks
grep -n '^CAUTION:' file.adoc

Lists

Unordered list items
grep -n '^\* ' file.adoc
Ordered list items
grep -n '^\. ' file.adoc
Unchecked tasks
grep -n '\[ \]' file.adoc
Checked tasks
grep -n '\[x\]' file.adoc

Tables

Table delimiters
grep -n '^\|===' file.adoc
Table column specs
grep -n '\[cols=' file.adoc

Images

Block images
grep -n '^image::' file.adoc
SVG diagrams
grep -n 'image::.*\.svg' file.adoc

Metadata

Description attribute
grep -n '^:description:' file.adoc
Nav title
grep -n '^:navtitle:' file.adoc
TOC attributes (should NOT exist)
grep -n ':toc' file.adoc

Anchors

Block anchors
grep -n '\[\[' file.adoc
Inline anchors
grep -n '\[#' file.adoc
Anchor references
grep -n '<<' file.adoc

Runbook Navigation

Phase Navigation

Find all phases
grep -n '^=== Phase' runbook.adoc
Find phase with context (30 lines)
grep -n -A30 '^=== Phase 3:' runbook.adoc
List phase titles only
grep -oE '^=== Phase [0-9]+:.*' runbook.adoc
Count phases
grep -c '^=== Phase' runbook.adoc
Find phase by keyword
grep -n '^=== Phase.*firewall' runbook.adoc
Show all section headers
grep -nE '^={2,4} ' runbook.adoc

Validation Blocks

Find pre-validation sections
grep -n -A10 'Pre-Validation' runbook.adoc
Find post-validation sections
grep -n -A10 'Post-Validation' runbook.adoc
Find PRE-N labels
grep -nE '\*\*PRE-[0-9]+\*\*' runbook.adoc
Find POST-N labels
grep -nE '\*\*POST-[0-9]+\*\*' runbook.adoc
Find Expected output blocks
grep -n -A5 'Expected:' runbook.adoc

Task Tracking

Find uncompleted checkboxes
grep -n '\[ \]' runbook.adoc
Find completed checkboxes
grep -n '\[x\]' runbook.adoc
Count TODO vs DONE
echo "TODO: $(grep -c '\[ \]' runbook.adoc)"; echo "DONE: $(grep -c '\[x\]' runbook.adoc)"
Find pending tasks with context
grep -n -B1 '\[ \]' runbook.adoc

Command Extraction

Find all source blocks
grep -n '\[source,' runbook.adoc
Find bash command blocks
grep -n '\[source,bash' runbook.adoc
Find VyOS set commands
grep -n '^set ' runbook.adoc
Find kubectl commands
grep -n 'kubectl' runbook.adoc
Find ssh commands
grep -n '^ssh ' runbook.adoc
Find variable assignments
grep -nE '^[A-Z_]+=.' runbook.adoc

Session Variables

Find session variables section
grep -n -A50 'Session Variables' runbook.adoc
Extract variable definitions
grep -nE '^[A-Z_]+="' runbook.adoc
List all variable names
grep -oE '^[A-Z_]+=' runbook.adoc | sort -u

Cross-References

Find all xrefs
grep -n 'xref:' runbook.adoc
Find cross-component xrefs
grep -nE 'xref:[a-z-]+::' runbook.adoc
Find include directives
grep -n 'include::' runbook.adoc

Admonitions

Find all warnings
grep -n 'WARNING:' runbook.adoc
Find all cautions
grep -n 'CAUTION:' runbook.adoc
Find all important notes
grep -n 'IMPORTANT:' runbook.adoc
Find warning with context
grep -n -A3 'WARNING:' runbook.adoc

Structure Analysis

Show document outline
grep -nE '^={1,4} ' runbook.adoc
Count sections by level
echo "L2: $(grep -c '^== ' runbook.adoc)"; echo "L3: $(grep -c '^=== ' runbook.adoc)"
Find tables
grep -n '^\|===' runbook.adoc
Runbook complexity summary
echo "Phases: $(grep -c '^=== Phase' runbook.adoc)"; echo "Validations: $(grep -c 'PRE-\|POST-' runbook.adoc)"; echo "Commands: $(grep -c '\[source,bash\]' runbook.adoc)"

Network Patterns

IP Addresses

Find all IPv4 addresses
grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}' file
Extract IPs only
grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' file
Unique IPs sorted
grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' file | sort -u
IPv4 with CIDR notation
grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}' file
DATA VLAN subnet
grep '10\.50\.1\.' file
MGMT VLAN subnet
grep '10\.50\.10\.' file
Private IP ranges
grep -E '(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)' file

MAC Addresses

Colon-separated (Unix)
grep -Ei '([0-9a-f]{2}:){5}[0-9a-f]{2}' file
Hyphen-separated (Windows)
grep -Ei '([0-9a-f]{2}-){5}[0-9a-f]{2}' file
Dot-separated (Cisco)
grep -Ei '([0-9a-f]{4}\.){2}[0-9a-f]{4}' file
Extract MACs only
grep -oEi '([0-9a-f]{2}:){5}[0-9a-f]{2}' file
VMware OUI
grep -Ei '(00:0c:29|00:50:56):' file

Ports

Port in URL format
grep -E ':[0-9]{1,5}(/|$| )' file
Common service ports
grep -E '\b(22|80|443|389|636|53|88|123)\b' file
Kubernetes ports
grep -E '\b(6443|10250|10251|10252)\b' file
Web service ports
grep -E '\b(8080|8443|9090|9200)\b' file

VLANs

VLAN ID references
grep -iE 'vlan[[:space:]]*[0-9]+' file
Extract VLAN IDs
grep -oiE 'vlan[[:space:]]*[0-9]+' file | grep -oE '[0-9]+'
Trunk configurations
grep -iE 'trunk|tagged|untagged' file

DNS

FQDN patterns
grep -E '[a-z0-9-]+\.[a-z0-9-]+\.[a-z]{2,}' file
Internal domain
grep '\.domusdigitalis\.dev' file
DNS record types
grep -iE '\b(A|AAAA|CNAME|MX|NS|PTR|SOA|SRV|TXT)\b' file
Nameserver references
grep -iE 'nameserver|dns[_-]?server' file

Firewall

VyOS firewall commands
grep '^set firewall' file
Firewall zones
grep -E 'zone[[:space:]]+(LAN|WAN|DMZ|MGMT|DATA)' file
Allow/Deny rules
grep -iE '\b(accept|permit|allow|drop|deny|reject)\b' file
Address groups
grep -E 'address-group|network-group' file

Routing

BGP patterns
grep -E 'bgp|as[[:space:]]*[0-9]+' file
BGP neighbors
grep -E 'neighbor[[:space:]]+[0-9]+\.' file
Static routes
grep 'set protocols static' file
Default gateway
grep -iE 'default[[:space:]]+(route|gateway)|0\.0\.0\.0/0' file
VRRP configuration
grep -iE 'vrrp|virtual[[:space:]]+router' file

Interfaces

Linux interface names
grep -E '\b(eth|ens|enp|eno)[0-9]+' file
Bridge interfaces
grep -E 'br[0-9]+|bond[0-9]+' file
VyOS interface config
grep 'set interfaces ethernet' file
VLAN subinterfaces
grep -E 'eth[0-9]+\.[0-9]+' file

Certificates

Certificate paths
grep -E '/etc/ssl/certs|\.pem|\.crt|\.key' file
Certificate subjects
grep -E 'CN=|O=|OU=' file
PEM markers
grep 'BEGIN CERTIFICATE\|END CERTIFICATE' file

Services

Infrastructure services
grep -iE '\b(vault|ise|bind|keycloak|wazuh|k3s)\b' file
Service URLs
grep -E 'https?://[a-z0-9-]+\.[a-z]+' file
Systemd services
grep -E '\.service\b' file

Hostnames

Host-NN pattern
grep -E '[a-z]+-[0-9]+' file
Infrastructure hosts
grep -E '(vault|ise|bind|k3s|kvm|vyos)-[0-9]+' file
List unique hosts
grep -oE '(vault|ise|bind|k3s|kvm|vyos|wazuh)-[0-9]+' file | sort -u

Attribute Extraction

Extract Definitions

All attributes from antora.yml
grep -E '^    [a-z]' antora.yml
Attribute names only
grep -oE '^    [a-z][a-z0-9-]*' antora.yml | tr -d ' '
Count total attributes
grep -c '^    [a-z]' antora.yml

By Category

Vault attributes
grep -E '^    vault-' antora.yml
ISE attributes
grep -E '^    ise-' antora.yml
k3s attributes
grep -E '^    k3s-' antora.yml
VyOS attributes
grep -E '^    vyos-' antora.yml
BIND attributes
grep -E '^    bind-' antora.yml
Port attributes
grep -E '^    port-' antora.yml
VLAN attributes
grep -E '^    vlan-' antora.yml

By Type

IP attributes
grep -E '^    [a-z]+-ip:' antora.yml
Hostname attributes
grep -E '^    [a-z]+-hostname:' antora.yml
MAC attributes
grep -E '^    [a-z-]+-mac:' antora.yml

Find Usage

All attribute refs in file
grep -n '{[a-z][a-z0-9-]*}' file.adoc
Unique attributes used
grep -oE '\{[a-z][a-z0-9-]*\}' file.adoc | sort -u
Count attribute usage
grep -oE '\{[a-z][a-z0-9-]*\}' file.adoc | sort | uniq -c | sort -rn
Find specific attribute usage
grep -rn '{vault-ip}' docs/
Files using specific attribute
grep -rl '{ise-pan-ip}' docs/

Validation

Check if attribute exists
grep -q '^    vault-ip:' antora.yml && echo "OK" || echo "MISSING"
Find attribute value
grep '^    vault-ip:' antora.yml
Match IP to attribute
grep '10.50.1.60' antora.yml
Source blocks with subs=attributes
grep -n 'subs=attributes' file.adoc

Audit Hardcoded

Hardcoded IPs (should be attributes)
grep -nE '([0-9]{1,3}\.){3}[0-9]{1,3}' file.adoc
Hardcoded IPs excluding attribute lines
grep -nE '([0-9]{1,3}\.){3}[0-9]{1,3}' file.adoc | grep -v '{.*-ip}'
Hardcoded hostnames
grep -nE '[a-z]+-[0-9]+\.inside\.domusdigitalis\.dev' file.adoc
IPs in backticks (bad pattern)
grep -n '`10\.' file.adoc

Reports

Count hardcoded vs attributes
echo "Hardcoded: $(grep -cE '([0-9]{1,3}\.){3}[0-9]{1,3}' file.adoc)"; echo "Attributes: $(grep -c '{[a-z-]*-ip}' file.adoc)"
Unique IPs in file
grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' file.adoc | sort -u
Most used attributes
grep -rhE '\{[a-z][a-z0-9-]*\}' docs/**/*.adoc | sort | uniq -c | sort -rn | head -20

Pre-Write Check

Verify attributes before writing
grep -oE '\{[a-z][a-z0-9-]+\}' file.adoc | tr -d '{}' | sort -u | while read attr; do grep -q "^    $attr:" antora.yml || echo "UNDEFINED: $attr"; done
Find undefined in staged files
git diff --cached --name-only -- '*.adoc' | xargs grep -ohE '\{[a-z][a-z0-9-]+\}' | tr -d '{}' | sort -u | while read attr; do grep -q "^    $attr:" antora.yml || echo "UNDEFINED: $attr"; done

Hardcoded Value Audit

Hardcoded IPs

Find all hardcoded IPv4
grep -nE '([0-9]{1,3}\.){3}[0-9]{1,3}' file.adoc
Extract unique IPs
grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' file.adoc | sort -u
Recursive in docs
grep -rnE '([0-9]{1,3}\.){3}[0-9]{1,3}' docs/**/*.adoc
Exclude attribute lines
grep -nE '([0-9]{1,3}\.){3}[0-9]{1,3}' file.adoc | grep -v '{.*-ip}'

Hardcoded Hostnames

FQDN patterns
grep -nE '[a-z]+-[0-9]+\.inside\.domusdigitalis\.dev' file.adoc
Short hostnames
grep -nE '\b(vault|ise|bind|k3s|kvm|vyos|wazuh)-[0-9]+\b' file.adoc
Exclude attribute lines
grep -nE '[a-z]+-[0-9]+\.inside\.' file.adoc | grep -v '{.*-hostname}'

Hardcoded Ports

Port numbers in config
grep -nE 'port[[:space:]]+[0-9]+' file.adoc
Common service ports
grep -nE '\b(22|80|443|389|636|53|88|123|8443|6443)\b' file.adoc
Exclude attribute lines
grep -nE 'port[[:space:]]+[0-9]+' file.adoc | grep -v '{port-'

Hardcoded MACs

MAC addresses
grep -niE '([0-9a-f]{2}:){5}[0-9a-f]{2}' file.adoc
Exclude attribute lines
grep -niE '([0-9a-f]{2}:){5}[0-9a-f]{2}' file.adoc | grep -v '{.*-mac}'

Bad Patterns

IPs in backticks
grep -n '`10\.' file.adoc
Hostnames in backticks
grep -nE '`[a-z]+-[0-9]+`' file.adoc

Attribute Verification

Check attribute exists
grep -q '^    vault-ip:' antora.yml && echo "OK" || echo "MISSING"
List all attributes
grep -E '^    [a-z]' antora.yml
Find IP attributes
grep -E '^    [a-z]+-ip:' antora.yml
Match IP to attribute
grep '10.50.1.60' antora.yml

Comparison

Count hardcoded vs attributes
echo "Hardcoded: $(grep -cE '([0-9]{1,3}\.){3}[0-9]{1,3}' file.adoc)"; echo "Attributes: $(grep -c '{[a-z-]*-ip}' file.adoc)"
Full audit summary
f="vyos-deployment.adoc"; echo "=== $f ==="; echo "IPs: $(grep -cE '([0-9]{1,3}\.){3}[0-9]{1,3}' $f)"; echo "Hosts: $(grep -cE '[a-z]+-[0-9]+\.inside\.' $f)"; echo "Attrs: $(grep -c '{[a-z-]*}' $f)"

Pre-Commit

Hardcoded IPs in staged files
git diff --cached --name-only | xargs grep -lE '([0-9]{1,3}\.){3}[0-9]{1,3}'
Undefined attributes in file
grep -oE '\{[a-z][a-z0-9-]+\}' file.adoc | tr -d '{}' | sort -u | while read attr; do grep -q "^    $attr:" antora.yml || echo "UNDEFINED: $attr"; done

See Also