Linux sed Command Tutorial: Find and Replace, Delete Lines and Edit Files In Place

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: fixing a wedding card list

Why do we need this?

Anil typed 300 guest names for wedding cards. Later he found: 'Pune' was typed as 'Poona' everywhere, he must delete every line marked 'cancelled', print only guests 50 to 80 for his sister, add 'Shri' before some names, and he wants a backup of the original list in case he makes a mistake.

What is it?

Replace Poona with Pune = sed 's/Poona/Pune/g'. Delete cancelled = sed '/cancelled/d'. Guests 50-80 = sed -n '50,80p'. Add Shri = sed 's/^/Shri /'. Backup = sed -i.bak.

How to do it (step by step)

2. Find and replace with s///

Why do we need this?

Changing a hostname, version or path across a file by hand is slow and error-prone.

What is it?

sed 's/old/new/' replaces the first match on each line. Flags: g all matches, i ignore case (GNU), 2 only the 2nd match, p print the changed line. Any character can be the separator: s#/old/path#/new/path# avoids escaping slashes. & in the replacement means 'the whole match'. Use double quotes only when you want a shell variable inside.

How to do it (step by step)

1. Replace the first match per line.

echo 'Poona to Poona' | sed 's/Poona/Pune/'

Output:

Pune to Poona

What it means: Only the first one changed.

2. Replace all.

echo 'Poona to Poona' | sed 's/Poona/Pune/g'

Output:

Pune to Pune

What it means: g = global.

3. Change a path with another separator.

echo 'root /var/www/old;' | sed 's#/var/www/old#/srv/shop#'

Output:

root /srv/shop;

What it means: No need to escape every /.

4. Use a shell variable.

V=2.4.1; sed "s/^version=.*/version=$V/" app.ini

Output:

name=shop
version=2.4.1

What it means: Double quotes let $V expand.

5. Wrap each match with &.

echo 'order 8812 and 8813' | sed -E 's/[0-9]+/#&/g'

Output:

order #8812 and #8813

What it means: & puts the matched number back.

6. Only print lines that changed.

sed -n 's/ERROR/E!/p' app.log | head -2

Output:

10:12:44 E! payment timeout
10:15:02 E! db refused

What it means: -n stops normal printing; p prints changed ones.

7. Remove trailing spaces and Windows CR.

sed -i 's/[[:space:]]*$//' deploy.sh && cat -A deploy.sh | head -1

Output:

#!/bin/bash$

What it means: [[:space:]] also covers \r.

3. Edit files in place with -i (and keep a backup)

Why do we need this?

Scripts and automation must change real files, not just print. One wrong sed -i can break a server, so backups matter.

What is it?

sed -i edits the file. sed -i.bak keeps the original as file.bak. On macOS (BSD sed) you must write sed -i '' for no backup. Always dry-run first without -i, or show a diff: sed 's/a/b/' f | diff f -. -i replaces the file, so it can change owner or break symlinks; use --follow-symlinks when the target is a link.

How to do it (step by step)

1. Dry run first.

sed 's/^Port 22$/Port 2222/' /etc/ssh/sshd_config | diff /etc/ssh/sshd_config -

Output:

17c17
< Port 22
---
> Port 2222

What it means: Shows exactly what will change.

2. Edit with a backup.

sudo sed -i.bak 's/^Port 22$/Port 2222/' /etc/ssh/sshd_config && ls /etc/ssh/sshd_config*

Output:

/etc/ssh/sshd_config  /etc/ssh/sshd_config.bak

What it means: The original is safe in .bak.

3. Validate before restart.

sudo sshd -t && sudo systemctl reload sshd

Output:

(no output)

What it means: Never restart SSH without testing the config.

4. Edit many files at once.

sed -i 's/old-db.local/db.prod.local/g' config/*.yml && grep -l db.prod.local config/*.yml

Output:

config/app.yml
config/worker.yml

What it means: Every .yml file is updated.

5. Restore from backup.

sudo mv /etc/ssh/sshd_config.bak /etc/ssh/sshd_config

Output:

(no output)

What it means: Undo is one move.

4. Addresses: choose which lines

Why do we need this?

Often you want to change only line 5, only lines in a section, or only lines that contain a word.

What is it?

Put an address before a command. N a line number, $ the last line, /re/ lines matching a regex, N,M a range, /start/,/end/ a regex range, N~S every S-th line from N (GNU), addr! all lines except addr. Example: sed '/^\[db\]/,/^\[/s/host=.*/host=10.0.0.9/' edits host only inside the [db] section.

How to do it (step by step)

1. Print lines 20 to 25.

sed -n '20,25p' app.log

Output:

(6 lines)

What it means: -n plus p prints only the range.

2. Print the last line.

sed -n '$p' app.log

Output:

10:59:59 INFO shutdown

What it means: $ is the last line.

3. Change only inside a section.

sed '/^\[db\]/,/^\[/s/^host=.*/host=10.0.0.9/' app.ini

Output:

[web]
host=0.0.0.0
[db]
host=10.0.0.9

What it means: The web host is untouched.

4. Logs between two times.

sed -n '/^10:00/,/^10:05/p' app.log | head -3

Output:

10:00:01 INFO start
10:00:02 GET /
10:01:10 GET /cart

What it means: A regex range is great for time windows.

5. Replace on every line except comments.

sed '/^#/!s/8080/9090/' app.conf

Output:

# default 8080
port=9090

What it means: ! negates the address.

6. Every 2nd line.

seq 1 6 | sed -n '0~2p'

Output:

2
4
6

What it means: first~step (GNU sed).

5. Delete, print, insert, append and change lines

Why do we need this?

Besides replace, you need to remove lines, add a new setting after a line, or replace a whole line.

What is it?

d deletes, p prints, i\ text inserts before, a\ text appends after, c\ text changes the whole line, = prints the line number, q quits (stop early, great for big files), r file reads a file in, w file writes matching lines out. GNU sed allows the one-line forms: '3i text', '/re/a text'.

How to do it (step by step)

1. Delete comments and blank lines.

sed '/^#/d; /^$/d' nginx.conf | head -3

Output:

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;

What it means: Two commands separated by ;.

2. Delete the first line (header).

sed '1d' sales.csv | head -2

Output:

2026-10-01,Pune,4500
2026-10-01,Nashik,3200

What it means: Same as tail -n +2.

3. Insert a line before line 1.

sed '1i # Managed by Ansible - do not edit' app.conf | head -2

Output:

# Managed by Ansible - do not edit
port=8080

What it means: i inserts before.

4. Append a setting after a match.

sed '/^\[mysqld\]/a max_connections=500' my.cnf

Output:

[mysqld]
max_connections=500
datadir=/var/lib/mysql

What it means: a adds after the matched line.

5. Change a whole line.

sed '/^SELINUX=/c SELINUX=permissive' /etc/selinux/config | grep ^SELINUX=

Output:

SELINUX=permissive

What it means: c replaces the full line, whatever it was.

6. Stop early on a huge file.

sed '10q' huge.log | wc -l

Output:

10

What it means: q quits after line 10. Like head, but inside sed.

7. Write matching lines to another file.

sed -n '/ERROR/w errors.txt' app.log && wc -l errors.txt

Output:

27 errors.txt

What it means: w saves matches without a pipe.

6. Extended regex, groups and back-references

Why do we need this?

You need to swap parts, reformat dates or keep part of a match while changing the rest.

What is it?

sed -E enables extended regex (+ ? {} | ( ) without backslashes). ( ) captures a group, and \1 \2 put the groups back in the replacement. GNU sed also has \U uppercase, \L lowercase and \E end case change in the replacement.

How to do it (step by step)

1. Swap first and last name.

echo 'Bagale Ravindra' | sed -E 's/(\w+) (\w+)/\2 \1/'

Output:

Ravindra Bagale

What it means: \1 is the first group, \2 the second.

2. Reformat a date.

echo '2026-10-25' | sed -E 's/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3\/\2\/\1/'

Output:

25/10/2026

What it means: Three groups, written back in a new order.

3. Mask card numbers in logs.

echo 'card=4111111111111111 ok' | sed -E 's/([0-9]{4})[0-9]{8}([0-9]{4})/\1********\2/'

Output:

card=4111********1111 ok

What it means: Keeps first and last 4 digits.

4. Uppercase a key name.

echo 'db_host=10.0.0.9' | sed -E 's/^([a-z_]+)=/\U\1\E=/'

Output:

DB_HOST=10.0.0.9

What it means: \U ... \E (GNU sed).

5. Pull a value out.

sed -nE 's/.*version="([^"]+)".*/\1/p' package.xml

Output:

3.2.0

What it means: Print only the captured version.

7. Many commands, scripts and safe habits

Why do we need this?

Real edits need several steps in one pass, and must be safe to run again and again (idempotent).

What is it?

Join commands with ; or -e, or use { } to group commands under one address. Save long edits in a file and run sed -f edits.sed. To make edits idempotent, match the full current line (^key=.*) so a second run changes nothing. For structured files (JSON, YAML, XML) prefer jq, yq or xmlstarlet; for big configs prefer Ansible lineinfile.

How to do it (step by step)

1. Two edits in one run.

sed -e 's/dev/prod/' -e '/debug/d' app.conf

Output:

env=prod
port=8080

What it means: -e can repeat.

2. Group commands under one address.

sed '/^\[db\]/,/^\[/{s/^user=.*/user=app/; s/^port=.*/port=5432/}' app.ini | sed -n '/\[db\]/,$p'

Output:

[db]
user=app
port=5432

What it means: { } applies both only inside [db].

3. A sed script file.

printf 's/Poona/Pune/g\n/cancelled/d\n' > fix.sed && sed -f fix.sed guests.txt | wc -l

Output:

288

What it means: 12 cancelled lines removed and the city fixed.

4. Idempotent set-or-add.

grep -q '^MaxAuthTries' /etc/ssh/sshd_config && sudo sed -i 's/^MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config || echo 'MaxAuthTries 3' | sudo tee -a /etc/ssh/sshd_config

Output:

(no output, or MaxAuthTries 3)

What it means: Runs safely many times.

5. Number every line (= command).

sed -n '/ERROR/=' app.log | head -3

Output:

57
90
131

What it means: = prints the line number of each match.

8. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

9. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

10. Troubleshooting step by step

Why do we need this?

When a sed edit does not do what you expect, test it in small steps without -i.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Confirm the line exists and see hidden characters.

grep -n '^Port' /etc/ssh/sshd_config | cat -A

2. Run without -i and diff the result.

sed 's/^Port 22/Port 2222/' /etc/ssh/sshd_config | diff /etc/ssh/sshd_config -

3. Check which sed you have.

sed --version | head -1

4. Check quotes: print the final expression.

echo "s/^version=.*/version=$V/"

5. After -i, check the file and its owner.

ls -l /etc/ssh/sshd_config*

6. Validate the service config before reload.

sudo sshd -t; sudo nginx -t

11. Lab 1: Clean up a guest list

Why do we need this?

Practise replace, delete, print ranges and backups on a safe file.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Create the list.

mkdir -p ~/lab10 && cd ~/lab10 && for i in $(seq 1 100); do echo "$i,Guest$i,Poona$([ $((i%10)) -eq 0 ] && echo ',cancelled')"; done > guests.txt; head -2 guests.txt

Output:

1,Guest1,Poona
2,Guest2,Poona

2. Fix the city (dry run).

sed 's/Poona/Pune/g' guests.txt | head -2

Output:

1,Guest1,Pune
2,Guest2,Pune

3. Apply with a backup.

sed -i.bak 's/Poona/Pune/g' guests.txt && ls guests*

Output:

guests.txt  guests.txt.bak

4. Delete cancelled guests.

sed -i '/cancelled/d' guests.txt && wc -l < guests.txt

Output:

90

5. Print guests 50 to 52.

sed -n '50,52p' guests.txt

Output:

55,Guest55,Pune
56,Guest56,Pune
57,Guest57,Pune

6. Add a title line at the top.

sed -i '1i id,name,city' guests.txt && head -1 guests.txt

Output:

id,name,city

12. Lab 2: Safe, repeatable config edits

Why do we need this?

Edit an ini file by section, make the edit idempotent and roll back.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Create an ini file.

cd ~/lab10 && printf '[web]\nhost=0.0.0.0\nport=80\n[db]\nhost=localhost\nport=3306\n' > app.ini

Output:

(no output)

2. Change only the db host.

sed -i.orig '/^\[db\]/,/^\[/s/^host=.*/host=10.0.0.9/' app.ini && cat app.ini

Output:

[web]
host=0.0.0.0
port=80
[db]
host=10.0.0.9
port=3306

3. Run it again: nothing changes.

sed '/^\[db\]/,/^\[/s/^host=.*/host=10.0.0.9/' app.ini | diff app.ini - && echo idempotent

Output:

idempotent

4. Append a setting under [db].

sed -i '/^\[db\]/a pool=20' app.ini && sed -n '/\[db\]/,$p' app.ini

Output:

[db]
pool=20
host=10.0.0.9
port=3306

5. Roll back.

mv app.ini.orig app.ini && grep host app.ini

Output:

host=0.0.0.0
host=localhost

13. Frequently asked questions

14. Interview questions and answers

Beginner level

Mid level level

Senior level

15. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.