grep/egrep logical AND function?

boozer_2 · 07-17-2005, 04:03 PM

I know one can use egrep for a logical OR search, but is there a way for a logical AND...

Say i want to search for BGP and 1.1.1.1

I know that:

egrep 'BGP|1.1.1.1' filename

will search for either BGP or 1.1.1.1

But I want them both. I know I can put multiple greps together to perform an AND like this:

cat filename | grep BGP | grep 1.1.1.1

but this seems like unecessary command line use to me. I like to keep things as short as possible. I searched around quite a bit and can't find anything on an AND function. Anyone know how to do it?

Thanks!

Tinkster · 07-17-2005, 04:25 PM

egrep -e "BGP.*1\.1\.1\.1" filename

boozer_2 · 07-17-2005, 05:05 PM

I need to clarify my question a bit. I need an AND function that will find 'x AND y' OR 'y AND x'. Your solution works as long as x precedes y, but I also want to find y followed by x using the shortest command possible. Is there not just an AND symbol or something like egrep 'x&y' which finds x.*y or y.*x? I figured that since they threw in an symbol for the OR logical function, I assumed there would be a symbol for AND, or similar simple way of performing the AND logical function.

eddiebaby1023 · 07-17-2005, 05:48 PM

Quote:

But I want them both. I know I can put multiple greps together to perform an AND like this:

cat filename | grep BGP | grep 1.1.1.1

but this seems like unecessary command line use to me. I like to keep things as short as possible. I searched around quite a bit and can't find anything on an AND function. Anyone know how to do it?

Your example doesn't show that you like to keep things as short as possible - using cat is pointless here! The shortest way I can think of is:

Code:

grep BGP filename | grep '1\.1\.1\.1'

In a single grep expression you'd have to do something like

Code:

egrep 'BGP.*1\.1\.1\.1|1\.1\.1\.1*BGP' filename

which is a little longer than the double grep above.

mhallbiai · 07-17-2005, 05:59 PM

correction to eddiebaby's last snippet, which should work but is missing the . before the 2nd *

Code:

egrep 'BGP.*1\.1\.1\.1|1\.1\.1\.1.*BGP' filename

boozer_2 · 07-17-2005, 07:02 PM

eddiebaby1023, I do like to keep things as short as possible, but I am fairly new to this as well. The way I was shown was to use cat when piping multiple greps, thank you for pointing out it is not necessary. That will definitely help me shorten things up.

Also, thanks for the examples. They work well with 2 variables. However, what would you do if the number of variables were increased?

For example, lets say you have a text log from thousands of hosts. You want to find a log entry that contains 15 hostnames, and the names could be in any order.
Is the only way to find that entry to pipe 15 greps together?

mhallbiai · 07-17-2005, 07:24 PM

boozer_2,
you may want to look into something a little more robust.
might i suggest (g)awk

Code:

cat filename | awk '/BGP/ && /1.1.1.1/'
cat filename | awk '/hostname1/ && /hostname2/ && /hostname3/ && ... /hostname14/ && /hostname15/'

rather than write hostname1-15, you get the idea

the second example would present only lines that contained all 15 hostnames (strings), not sure what logs you would be looking at that would have 15 hostnames on a single line but there it is

this will give you the logical ANDing that you were seeking

hope this helps

Tinkster · 07-17-2005, 07:32 PM

Not lazy enough ;}

Code:

awk '/BGP/ && /1.1.1.1/' filename

mhallbiai · 07-17-2005, 07:53 PM

it never is Tinkster, it never is

mikeuguru · 04-09-2010, 05:23 PM

I believe you are looking for:

awk '/BGP/ || /1.1.1.1/' filename

The other one will only give you lines where both are, this way it would be more like grep with a logical &&

makyo · 04-09-2010, 09:33 PM

Hi.]

Sigh. I didn't notice until after this post that this was such an old resurrected thread.

Quote:

Originally Posted by boozer_2

But I want them both. ...

You may be interested in:

Code:

NAME
       glark - Search text files for complex regular expressions

SYNOPSIS
       glark [options] expression file ...

DESCRIPTION
       Similar to "grep", "glark" offers: Perl-compatible regular expressions,
       color highlighting of matches, context around matches, complex expres-
       sions ("and" and "or"), grep output emulation, and automatic exclusion
       of non-text files. Its regular expressions should be familiar to per-
       sons experienced in Perl, Python, or Ruby. File may also be a list of
       files in the form of a path.

It was in the Debian repository that I use, but if not in yours, see
http://www.incava.org/projects/glark/

Best wishes ... cheers, makyo

grail · 04-10-2010, 02:19 AM

I believe this needs a slight adjustment:

Code:

awk '/BGP/ && /1\.1\.1\.1/' filename

Otherwise you will match lines like BGP <blah> 1213141 which is not what the OP wants

Quote:

I believe you are looking for:

awk '/BGP/ || /1.1.1.1/' filename

The other one will only give you lines where both are, this way it would be more like grep with a logical &&

Not sure how you get logical && out of this as it would return lines with only BGP on them which is not && and not
what OP requested