grep & ripgrep Recipe Builder

About this tool

Log triage is mostly the same handful of searches, but the exact grep flags are easy to forget and ripgrep's differ in small ways. This builder asks what you want to do and writes both commands for you. Find a fixed string (so dots and slashes are literal) or an extended regular expression, with options for ignore-case, whole-word, invert, count-only, line numbers, context lines and recursive search. Extract just the matching parts (IPv4, IPv6, email, URL, MAC or UUID, or your own regex), one per line, with an option to remove duplicates. Count and rank unique values, most frequent first, which is the usual "which IP hit us most" question. Filter to lines that match one pattern but not another. Two presets cover common cases: failed SSH logins (the OpenSSH "Failed password" lines, with an option to rank the source IPs), and access-log lines by HTTP status class such as 5xx. Values you type are quoted for a POSIX shell, so a pattern with a quote or a path with spaces or special characters cannot break the command or run something unintended. Every recipe was checked by running the real grep and the real ripgrep against sample logs and confirming the two commands give identical, correct output. Nothing runs in the browser and no file is read here; copy a command and run it in your own shell, on logs you are allowed to read. The grep commands assume GNU grep; BSD/macOS grep is close but a few flags differ.

How to use it

1. Choose a task from the list.
2. Fill in the pattern or value and the file or path.
3. Turn on any options you need (ignore case, count, context…).
4. Copy the grep or the ripgrep command and run it in your shell.

Example

The ripgrep form is shown alongside and gives the same result.

Task: Failed SSH logins · File: /var/log/auth.log · Rank the source IPs

grep -E 'Failed password' /var/log/auth.log | grep -oE '…ipv4…' | sort | uniq -c | sort -rn

Common problems

My grep does not accept a flag

The grep commands assume GNU grep (Linux). On macOS/BSD, -E, -o, -i, -v, -w, -c and -n work, but recursive and some long options differ. ripgrep behaves the same everywhere.

The extractor misses some matches

The built-in patterns are deliberately simple so they are fast and predictable. For unusual formats choose Custom and supply your own extended regex; test it first with the regex tester.

ripgrep returns fewer results than grep

For recursive search the builder adds --no-ignore --hidden to the ripgrep command so it matches grep -r. If you prefer ripgrep’s default (skip .gitignore and hidden files), remove those two flags.