grep does not open a file and rummage. It reads one line at a time, tests the pattern against that line, and prints the whole line if the pattern matches anywhere in it. Everything else follows from this.

So a match is not a word floating free: it is a line containing it. With no file named, grep reads what you pipe into it. A file named - means standard input, and recursive searches with no file start in the working directory.

Think lines first. The pattern is only the test each line must pass.

Your pattern passes through the shell before grep ever sees it. Unquoted, a star becomes a list of file names, a dollar becomes a variable, a space splits arguments. Half of all grep confusion is the shell quietly rewriting the pattern.

The fix is one habit: single-quote every pattern, always. Single quotes stop the shell entirely, so backslashes and metacharacters arrive intact. If the pattern itself may start with a dash, add -e in front or a bare double dash before it.

Type it, quote it, run it. The pattern you wrote is the one that runs.

Ask grep for the empty string and you get every line back, because every line contains nothing. Bare caret or bare dollar do the same: they match a position, and every line has positions.

The empty pattern also explains the star surprise: a pattern that can match nothing matches everywhere. To find empty lines use the caret-dollar pair; to match nothing at all, put a caret after text.

Every line contains the empty string. One sentence, a whole family of bugs defused.

grep speaks two regex dialects. The default is basic, where question, plus, brace, pipe and parentheses are plain characters unless backslashed. Add -E for extended, where they are special bare.

That is the whole rule, and it is why a plus that worked in an online example fails when you paste it into plain grep. The manual lists the six symbols both ways; GNU basic and extended have equal power, and -E is easier to read.

Bare grep means basic; grep -E means extended.

Two symbols pin a match to a line's edges: caret for the start, dollar for the end. They match positions, not characters, so they cost nothing to add and everything to forget.

Most patterns should carry one: log at a line's end stops you matching logger mid-sentence. One footnote: in basic mode, a caret stuck mid-pattern stops being an anchor and turns literal, so keep it first.

Anchor first, anchor last. The cheapest precision you will ever buy.

Some days you do not want a pattern, you want a string: a dotted version number, a star in a config, a price with a dollar sign. Literal mode takes every character at face value, no escaping, no backslashes, no dialect to choose.

It is faster too, because grep can skip the regex engine. Stack it with -e for several fixed strings at once, or point -f at a file of them, one per line. The old name you will meet in scripts is fgrep.

Searching for a thing with dots and stars in it means -F day. Zero escaping, exact text.

Two switches turn grep into a reporter. Count suppresses the lines and prints a number per file, zero included, which is a dashboard in one flag. List prints only the file names that matched, and stops scanning each file at its first hit, because one hit is all the answer needs.

Name control rides along: with several files grep prefixes names by default, lowercase h silences them, and capital H, a GNU extension, forces the name even for one file, which is why scripts love it.

How many is -c. Which files is -l. Both skip printing the lines entirely.

grep talks to scripts with exit codes: 0 found, 1 clean none, 2 broken. That is why a not-found can kill a set-e script: one is an answer, not an error.

Two habits finish the toolkit: the bracket trick when searching ps output, so the pattern cannot match the grep line itself, and chaining greps for AND. Even cat is optional: grep reads files and standard input natively.

0 found, 1 none, 2 error. Pipe to narrow, bracket to hide, chain for AND.