Text Processing

By the end of this lesson you'll be able to search, slice, summarise, and transform text from the command line — and chain those tools into a real log-analysis pipeline that answers questions in seconds, not minutes.

Learn Python, JavaScript, Java and more with free interactive lessons, real projects and AI-powered help. Beginner-friendly.

Part of the free Cli course at LearnCodingFast — hands-on lessons with examples you run in your browser, plus practice exercises and a quick quiz.

Setup: a log file to practise on

Every example in this lesson works on the same web-server log. Run this block first to create access.log in your current folder. Each line has the same shape: date time LEVEL METHOD url status user — handy because each piece sits in its own column.

1️⃣ grep — search for patterns

grep ("Global Regular Expression Print") scans a file line by line and prints every line that matches your pattern. A handful of flags do most of the work: -i ignores case, -n adds line numbers, -v inverts the match (lines that don't match), -r searches a whole folder, and -E turns on extended regex so | means "or".

Fill in the blank with the flag that prints line numbers, then run it and check the output matches.

2️⃣ find — locate files

Where grep searches inside files, find searches for files by name, type, size, or age. Give it a starting folder ( . means "here") and conditions like -name "*.log" or -mtime -1 (changed in the last day). With -exec you can even run another command — like grep — on every file it finds.

3️⃣ cut, sort, uniq -c & wc — slice and summarise

Most logs are columns. cut -d' ' -f4 splits on a space and keeps field 4. The classic counting trick is sort | uniq -c : uniq only collapses adjacent duplicates, so you must sort first to group identical lines together; -c then prefixes each with its count. Add another sort -rn to rank biggest-first, and wc -l to count lines.

4️⃣ head & tail — peek at the ends

head -3 shows the first 3 lines; tail -2 shows the last 2. They're perfect on the end of a pipeline to keep just the "top N" results. The killer feature is tail -f ("follow"): it stays open and prints new lines as they're written, so you can watch a live server log in real time (press Ctrl + C to stop).

5️⃣ sed — find and replace

sed ("stream editor") transforms text as it flows past. Its bread-and-butter is substitution: sed 's/old/new/' replaces the first match on each line, and adding /g replaces every match. By default it prints the result and leaves your file untouched — -i rewrites the file in place with no undo , so always preview first.

6️⃣ awk — a gentle intro to fields

awk is a tiny language for columnar text. It reads each line and splits it into fields you reference by number: $1 is the first field, $2 the second, and $0 the whole line. {"awk ' '"} prints the first two columns; put a /pattern/ before the braces to act only on matching lines. That's already enough to do real work.

This pipeline is almost done. Fill in the one missing step so the counts come out right (remember the rule about uniq ).

Here's a single script that answers the questions an on-call engineer actually asks — total traffic, a breakdown by level, every error with its line number, the busiest page, and who hit the most errors. Every line uses a tool from this lesson. Read it top to bottom; you understand all of it now.

No blanks this time — just a brief and an outline. Build the pipeline yourself on access.log (or any log you have), run it, and check it against the expected snippet in the comments. This is exactly the kind of throwaway analysis engineers run every day.

This was the final lesson in the Command Line course — you can now navigate the filesystem, manage files, control permissions, write small scripts, chain commands with pipes, and slice through text like a pro. Where next? Take these skills into the Git course to version-control your projects, or revisit the CLI course overview to fill any gaps. The terminal is now yours. 🚀

Practice quiz

What does the grep command do?

  • Renames files
  • Prints lines that match a pattern
  • Counts directories
  • Deletes text

Answer: Prints lines that match a pattern. grep prints every line that matches a pattern.

Which grep flag makes the search case-insensitive?

  • -i
  • -n
  • -v
  • -r

Answer: -i. -i ignores case, so warn, WARN and Warn all match.

Which grep flag inverts the match, showing lines that do NOT match?

  • -i
  • -n
  • -v
  • -E

Answer: -v. -v inverts the match, printing non-matching lines.

Which grep flag adds line numbers to the output?

  • -r
  • -E
  • -i
  • -n

Answer: -n. -n prefixes each matching line with its line number.

Why must you run sort before uniq -c when counting?

  • uniq only collapses adjacent duplicates
  • sort deletes blanks
  • uniq needs root
  • It runs faster

Answer: uniq only collapses adjacent duplicates. uniq only merges duplicates that are next to each other, so sort first.

What is the main difference between find and grep?

  • They are identical
  • find searches for files; grep searches text inside files
  • find edits files; grep deletes them
  • grep finds folders only

Answer: find searches for files; grep searches text inside files. find locates files by name/type/age; grep searches text inside them.

What does sed mainly do?

  • Lists processes
  • Counts words
  • Find-and-replace on text streams
  • Changes permissions

Answer: Find-and-replace on text streams. sed is a stream editor whose number-one job is find-and-replace.

What does the -i flag do to sed?

  • Ignores case
  • Adds line numbers
  • Inverts the match
  • Rewrites the file in place with no undo

Answer: Rewrites the file in place with no undo. sed -i edits the file in place; always preview without it first.

In awk, what does $1 refer to?

  • The first field of each line
  • The whole line
  • The last field
  • The filename

Answer: The first field of each line. awk splits each line into fields; $1 is the first, $0 is the whole line.

Which grep flag turns on extended regex so | means OR?

  • -r
  • -E
  • -v
  • -c

Answer: -E. -E enables extended regex, so ERROR|WARN matches either.