The program I am working on makes use of grep to search a system log for a particular alert, however the an element of the syslog entry I am looking for will pertain specifically to that entry, and therefore be effectively “random.”

An example of what I think I’m looking for would be:

tail -f log | grep "string {ignore} string"

Thanks in advance.


You need to use WildCards (or Globbing Patterns) in the grep command like this :

 tail -f log | grep "some_string.*some_string"

Where, .* (Also pointed by @dsstorefile1 in the comments) is the globbing pattern used here. To get more details on Globbing Patterns refer to manpages.

man 7 glob

Which will show this :

     . (dot) : will match any single character (except end of line) , 
               equivalent to ? (question mark) in standard wildcard expressions.

* (asterisk) : the proceeding item is to be matched zero or more times.
               ie. n* will match n, nn, nnnn, nnnnnnn
                           but not na or any other character.

Now, Combining both of these you get :

.* (dot and asterisk) : match any string, equivalent to * in standard wildcards.

Also, as pointed by @Bob in comments, using .*? is much better than .*

| improve this answer | |
  • 2
    .* is greedy and might capture more than you want. .*? is usually better. – Bob May 5 '18 at 5:34
  • 1
    That has nothing to do with "? in place of .". Read my comment again - the ? is a modifier on *, making it lazy instead of the greedy default. Assuming PCRE. – Bob May 5 '18 at 6:25
  • 2
    I should also point out that this is regex (grep doing POSIX regex by default), not a shell glob. – Bob May 5 '18 at 6:26
  • @Bob edited my answer and Could you please clarify more about How .* is more greedy and using .*? instead. – C0deDaedalus May 5 '18 at 6:34
  • 1
    globbing != regex – Cyrus May 5 '18 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.