Introduction

Chapter 1

Introduction to AWK

What it's actually for, the pattern-action structure, and your first real one-liners

AWK is a programming language built around one specific idea: process text line by line, splitting each line into fields automatically, and run an action whenever a pattern matches. Where SED (the companion course to this one) excels at find-and-replace text transformation, AWK excels at anything involving structured, column-based data — log files, CSVs, command output — anywhere "this is field 3 of this line" is a meaningful thing to say.

The Pattern-Action Structure

Every AWK program, no matter how complex, is built from the same fundamental unit: a pattern paired with an action. AWK reads input one line at a time, checks the pattern against the current line, and runs the action if it matches.

pattern { action }

↑ when should this run? ↑ what should it do?

$ # Pattern: lines containing "ERROR" — Action: print the whole line
$ awk '/ERROR/ { print }' app.log

Either half can be omitted, with a specific meaning each time:

No pattern, just { action }

Runs the action on every line — no filtering at all.

Just a pattern, no { }

Defaults to printing the entire matching line — the most common AWK one-liner shape, equivalent to grep for that pattern.

$ # Just a pattern — print every matching line (like grep)
$ awk '/ERROR/' app.log

$ # Just an action — runs for every single line, no filtering
$ awk '{ print "Line: " $0 }' app.log

Your First Real Programs

$ # Print the whole line, exactly like cat
$ awk '{ print }' file.txt

$ # Print only lines longer than 80 characters
$ awk 'length > 80' file.txt

$ # Print lines matching a regex pattern (more on this in Chapter 3)
$ awk '/^#/ { print "comment: " $0 }' config.conf

Multiple Pattern-Action Pairs

A single AWK program can have several pattern-action pairs — each line of input is checked against every pattern in order, and every matching action runs (not just the first match).

$ awk '
/ERROR/ { print "Found error: " $0 }
/WARN/ { print "Found warning: " $0 }
' app.log

AWK vs grep vs sed — When to Reach for Each

🔍 grep

Find lines matching a pattern. Nothing more — no field access, no transformation.

✂️ sed

Transform text in place — substitution, deletion, insertion. Operates on the whole line as text, not structured fields.

📊 AWK

Everything grep and sed can do, plus genuine field-based processing, variables, arithmetic, and control flow — a real (if small) programming language.

It's common, and often correct, to pipe all three together

A realistic command-line workflow might use grep to narrow down which lines matter, pipe into awk to extract specific fields or compute something, and finish with sed for a final text cleanup — three small, composable tools rather than one tool trying to do everything. Chapter 8 of this course returns to exactly this kind of combined pipeline.

Running AWK — Three Ways

$ # Inline, single-quoted (the most common way, used throughout this course)
$ awk '{ print $1 }' file.txt

$ # From a script file, with -f
$ awk -f myscript.awk file.txt

$ # Reading from a pipe instead of a file
$ ps aux | awk '{ print $1 }'

Always single-quote AWK programs in the shell

AWK programs use $1, $2, etc. for field references (Chapter 2) — inside double quotes, the shell would try to expand those as its own variables before AWK ever sees them. Single quotes prevent any shell expansion, letting AWK interpret the program exactly as written.

Command Reference

Form	What it does
awk 'pattern { action }' file	Run action on lines matching pattern
awk '{ action }' file	Run action on every line, no filtering
awk 'pattern' file	Print every matching line (default action)
awk -f script.awk file	Run a program from a script file

Chapter 1 Quick Reference

pattern { action } — the fundamental unit of every AWK program
No pattern = runs on every line; no action = defaults to printing the matched line
Multiple pattern-action pairs are checked independently against every line — all matches run, not just the first
AWK vs grep vs sed: grep finds, sed transforms text, AWK does structured field processing with real programming constructs
Always single-quote AWK programs in the shell — prevents the shell from expanding $1, $2, etc. itself
Next chapter: fields and records — $0, $1, NF, NR, and field separators