The Pattern-Action Model
Every AWK program is a sequence of pattern { action } rules. For each input record, AWK tests the pattern; if it evaluates true, the associated action runs. Omitting the action defaults to printing the whole record ($0), while omitting the pattern makes the action run on every record. A pattern can be a regular expression written between slashes like /error/, a relational or boolean expression such as $3 > 100, a combination joined with && and ||, or a range pattern separated by a comma. This declarative structure is what makes AWK concise: you describe which lines matter and what to do with them.
Cricket analogy: Like a fielding plan that says 'if the ball is short and wide, cut it for four' — the condition (pattern) triggers the shot (action), and no condition means play every ball the same way.
Regular Expression Patterns
A regex pattern written as /regex/ matches when the regular expression is found anywhere in $0. AWK uses POSIX Extended Regular Expressions, so metacharacters like ^, $, ., *, +, ?, [], (), and {} carry their usual meaning: ^root matches lines starting with root, [0-9]+ matches one or more digits, and (cat|dog) matches either alternative. You can anchor a match to a specific field using the ~ (match) and !~ (no-match) operators, for example $1 ~ /^a/ tests only the first field. Escaping a metacharacter with a backslash, such as /\./ to match a literal dot, is essential when the character would otherwise be special.
Cricket analogy: The ~ operator is like a scout who only checks a batter's front-foot technique ($1) rather than the whole innings — you anchor the pattern to one specific field of play.
Relational, Boolean, and Range Patterns
Patterns are not limited to regexes. A relational expression like NF > 5 or $3 == "active" runs the action only when the comparison holds. You combine conditions with && (and), || (or), and ! (not), for example /error/ && $2 > 500. Range patterns use two patterns separated by a comma: /START/,/END/ turns the action on when the first pattern matches and off after the second matches, inclusive on both ends — perfect for extracting blocks of text between markers. AWK evaluates string and numeric comparisons contextually, so quoting matters: "10" < "9" is true as strings but 10 < 9 is false numerically.
Cricket analogy: A range pattern /START/,/END/ is like recording every ball from the fall of the first wicket to the fall of the fifth — the block between two triggering events, endpoints included.
# Print lines containing 'error' (regex pattern, default action)
awk '/error/' logfile.txt
# Field-anchored match: usernames starting with 'a' in /etc/passwd
awk -F: '$1 ~ /^a/ { print $1 }' /etc/passwd
# Boolean pattern: errors with a status code over 500
awk '/ERROR/ && $NF > 500 { print }' access.log
# Range pattern: extract lines between BEGIN_CONFIG and END_CONFIG
awk '/BEGIN_CONFIG/,/END_CONFIG/' settings.confThe dynamic regex feature lets you store a pattern in a variable or field and match against it: $0 ~ pat works when pat holds a string like "^error". This enables regexes built at runtime from user input or configuration.
AWK compares values as numbers when both look numeric and as strings otherwise, which can surprise you: $1 == 0 may match the string "abc" in some implementations because it coerces to 0. Force a string comparison by concatenating an empty string, e.g. $1 "" == "0".
- Every rule is pattern { action }; a missing pattern matches all lines, a missing action prints $0.
- /regex/ patterns use POSIX Extended Regular Expressions and match anywhere in $0.
- Use ~ and !~ to test a regex against a specific field rather than the whole record.
- Relational and boolean patterns (>, ==, &&, ||, !) filter records by computed conditions.
- Range patterns /START/,/END/ act on inclusive blocks between two matching lines.
- Comparison is numeric or string depending on context, so quoting affects the result.
- Dynamic regexes stored in variables allow runtime-built pattern matching.
Practice what you learned
1. What does an AWK rule with a pattern but no action do?
2. Which operator tests a regex against a specific field?
3. What does the range pattern /START/,/END/ match?
4. Which regex class does AWK use for its patterns?
5. Why might $1 == 0 unexpectedly match a non-numeric field?
Was this page helpful?
You May Also Like
Built-in Variables in AWK
AWK ships with a set of predefined variables such as NR, NF, FS, and OFS that expose the current record, field counts, and formatting controls without any setup.
Field Separators and Record Separators
FS and RS govern how AWK splits input into fields and records, while OFS and ORS control how output is reassembled; mastering them unlocks CSV, multiline, and custom-delimited parsing.
BEGIN and END Blocks
BEGIN runs once before any input is read and END runs once after all input is consumed, giving AWK programs a clean place for setup, headers, and final aggregate reporting.
Related Reading
Related Study Notes in Programming
Browse all study notesApache Spark Study Notes
Programming · 30 topics
ProgrammingApache Flink Study Notes
Programming · 30 topics
ProgrammingHadoop Study Notes
Programming · 30 topics
ProgrammingSnowflake Study Notes
Programming · 30 topics
ProgrammingApache Airflow Study Notes
Programming · 30 topics
Programmingdbt (Data Build Tool) Study Notes
Programming · 30 topics