Mastering grep: How to Search Through .gz Files

Introduction

Gz files are widely used for storing logs and backups, but they can't be searched directly with regular grep, which is a common point of confusion for beginners.

By learning not only how to decompress and then search, but also how to search efficiently without decompressing, you can significantly reduce your working time.

This article clearly explains everything from the basics to practical search methods for handling gz files with grep.

Reference: GNU grep

Basic command for searching gz files with grep

Create the file

cat << 'EOF' > sample1.txt
backup data
EOF

Create the file

gzip -c sample1.txt > sample1.txt.gz

Create the file

cat << 'EOF' > sample2.txt
access log
EOF

Create the file

gzip -c sample2.txt > sample2.txt.gz

Create the file

cat << 'EOF' > sample3.txt
database dump
EOF

Create the file

gzip -c sample3.txt > sample3.txt.gz

Command to run

grep "backup" *.gz

Result

no output

Command to run

zgrep "backup" *.gz

Result

sample1.txt.gz:backup data

How it works

Item	Description
grep	Command that searches for a specified string
zgrep	Command that searches .gz files without decompressing them
*.gz	Targets all .gz files in the current directory

Explanation

Regular grep cannot search the contents of compressed .gz files directly.

When you need to search for a string inside a .gz file, it's common to use zgrep.

How to search gz files with grep without decompressing them

Create the file

cat << 'EOF' > input.txt
ERROR: Connection failed
INFO: Service started
ERROR: Disk full
INFO: Backup completed
EOF

Create the file

gzip -c input.txt > input.txt.gz

Command to run

zgrep "ERROR" input.txt.gz

Result

ERROR: Connection failed
ERROR: Disk full

Command to run

zgrep -n "INFO" input.txt.gz

Result

2:INFO: Service started
4:INFO: Backup completed

How it works

Item	Description
Command	zgrep
Target	Compressed files in .gz format
Decompression	Happens internally and temporarily, so no manual extraction is needed
Search processing	The same regular expressions and options as grep can be used
Use case	Convenient when you want to search compressed log files as they are

Explanation

Using zgrep lets you search gz files directly without decompressing them.
It's a command that's commonly used in operations settings too, since it makes investigating log files and searching large compressed files efficient.

How to search multiple gz files with grep

Create the file

mkdir -p logs

Create the file

echo "INFO Application started" | gzip > logs/app1.log.gz
echo "ERROR Database connection failed" | gzip > logs/app2.log.gz
echo "INFO User login" | gzip > logs/app3.log.gz
echo "ERROR Disk full" | gzip > logs/app4.log.gz

Command to run

zgrep "ERROR" logs/*.gz

Result

logs/app2.log.gz:ERROR Database connection failed
logs/app4.log.gz:ERROR Disk full

Command to run

zgrep -n "INFO" logs/*.gz

Result

logs/app1.log.gz:1:INFO Application started
logs/app3.log.gz:1:INFO User login

Command to run

zgrep -H "Database" logs/*.gz

Result

logs/app2.log.gz:ERROR Database connection failed

How it works

Item	Description
zgrep	Command that can search gzip-compressed files without decompressing them
logs/*.gz	Wildcard that lets you specify multiple gz files at once
-n	Displays the matching line number
-H	Always displays the file name in the search results
Search processing	Temporarily decompresses each gz file and runs the same search as grep

Explanation

Since grep can't search compressed gz files directly, zgrep is normally used instead.
By specifying a wildcard like logs/*.gz, you can search multiple gz files at once.

How to recursively search gz files in a directory with grep

Create the file

cat << 'EOF' > file1.txt
ERROR Failed to connect database
ERROR Authentication failed
EOF

Create the file

gzip -c file1.txt > file1.txt.gz

Create the file

gzip -c file1.txt > file2.txt.gz

Create the file

gzip -c file1.txt > file3.txt.gz

Command to run

find . -type f -name "*.gz" -print0 | xargs -0 zgrep "ERROR"

Result

./file1.txt.gz:ERROR Failed to connect database
./file1.txt.gz:ERROR Authentication failed
./file3.txt.gz:ERROR Failed to connect database
./file3.txt.gz:ERROR Authentication failed
./file2.txt.gz:ERROR Failed to connect database
./file2.txt.gz:ERROR Authentication failed

How it works

Item	Description
find	Recursively searches under the specified directory
-type f	Targets only regular files
-name "*.gz"	Extracts only files with the .gz extension
-print0	Outputs in a format that can be safely passed even if file names contain spaces
xargs -0	Safely passes find's results to zgrep
zgrep	Searches for a string without decompressing gzip files

Explanation

Since .gz files can't be searched directly with regular grep, zgrep is used instead.
Combining it with find lets you efficiently search all gzip files under a directory.

How to search gz files and regular files at the same time with grep

Create the file

cat << 'EOF' > input.txt
sample text
error: normal file
warning: normal file
EOF

Create the file

gzip -c input.txt > input.txt.gz

Command to run

grep -H "error" input.txt <(gzip -cd input.txt.gz)

Result

input.txt:error: normal file
/dev/fd/63:error: normal file

Command to run

zgrep -H "error" input.txt.gz && grep -H "error" input.txt

Result

input.txt.gz:error: normal file
input.txt:error: normal file

How it works

Method	How it works	Characteristics
grep <(gzip -cd file.gz)	gzip -cd decompresses the gz file to standard output, and process substitution passes it to grep	Lets grep alone search regular files and gz files at the same time
zgrep + grep	zgrep decompresses and searches the gz file while grep searches the regular file	Easier to display search results while keeping the file names

Explanation

If you want to search regular files and gz files at once, passing gzip -cd to grep via process substitution is convenient.
If you want to display the file names as they are, combining zgrep and grep is also commonly used.

How to search gz files with a regular expression using grep

Create the file

cat << 'EOF' > input.txt
2024-01-01 INFO Application started
2024-01-01 ERROR Database connection failed
2024-01-01 INFO Retry connection
2024-01-01 ERROR Authentication failed
2024-01-01 INFO Application stopped
EOF

Create the file

gzip -c input.txt > input.txt.gz

Command to run

grep "ERROR" <(gzip -cd input.txt.gz)

Result

2024-01-01 ERROR Database connection failed
2024-01-01 ERROR Authentication failed

Command to run

grep -E "ERROR|Retry" <(gzip -cd input.txt.gz)

Result

2024-01-01 ERROR Database connection failed
2024-01-01 INFO Retry connection
2024-01-01 ERROR Authentication failed

How it works

Item	Description
Command	grep
Target	The contents of the gz file decompressed through process substitution
Regular expression	Extended regular expressions are used with the -E option
Process substitution	<(gzip -cd input.txt.gz) passes the decompressed output as standard input

Explanation

gzip -cd decompresses the gz file to standard output, and process substitution <(...) passes it to grep.
Specifying the -E option lets you run regular expression searches with multiple conditions, like ERROR|Retry.

How to search for an exact string match in a gz file with grep

Create the file

cat << 'EOF' > input.txt
error
warning
info
error
EOF

Create the file

gzip -c input.txt > input.txt.gz

Command to run

zgrep -x "error" input.txt.gz

Result

error
error

Command to run

zgrep -xc "error" input.txt.gz

Result

How it works

Item	Description
zgrep	Command that searches gzip-compressed files without decompressing them
-x	Only displays a match when the entire line matches the search string exactly
-c	Only displays the count of matching lines
input.txt.gz	The gzip-compressed file to search

Explanation

Since zgrep runs grep internally while decompressing the gzip file, no temporary decompression is required.

Specifying -x only produces a hit when the entire line matches the search string.

How to search for multiple keywords inside a gz file with grep

Create the file

cat << 'EOF' > input.txt
INFO Start application
ERROR Database connection failed
WARN Retry connection
INFO User login
ERROR Timeout occurred
WARN Disk usage high
EOF

Create the file

gzip -c input.txt > input.txt.gz

Command to run

zgrep -E 'ERROR|WARN' input.txt.gz

Result

ERROR Database connection failed
WARN Retry connection
ERROR Timeout occurred
WARN Disk usage high

Command to run

gzip -cd input.txt.gz | grep -E 'ERROR|WARN'

Result

ERROR Database connection failed
WARN Retry connection
ERROR Timeout occurred
WARN Disk usage high

How it works

Item	Description
zgrep	Command that searches while decompressing a gzip-compressed file
-E	Uses extended regular expressions, letting you specify multiple keywords like ERROR\|WARN
\|	Represents an OR condition, searching for lines matching any of the keywords
gzip -cd	Decompresses the gz file to standard output
grep -E	Searches the decompressed content for multiple keywords

Explanation

Since grep can't search gz files directly, use zgrep or combine gzip -cd with a pipe.
Multiple keywords can be specified in the form grep -E 'keyword1|keyword2'.

How to check the number of matches inside a gz file with grep

Create the file

cat << 'EOF' > input.txt
INFO Start
ERROR Connection failed
INFO Retry
ERROR Timeout
INFO End
EOF

Create the file

gzip -c input.txt > input.txt.gz

Command to run

zgrep -c "ERROR" input.txt.gz

Result

Command to run

zgrep "ERROR" input.txt.gz | wc -l

Result

Command to run

gzip -cd input.txt.gz | grep -c "ERROR"

Result

How it works

Command	How it works	Use case
zgrep -c "ERROR" input.txt.gz	Searches while decompressing the gzip file and only displays the number of matches	When you want to quickly check the number of matches
zgrep "ERROR" input.txt.gz \| wc -l	Outputs the lines matched by zgrep and counts them with wc -l	When you want to count the matches while also viewing the matched content
gzip -cd input.txt.gz \| grep -c "ERROR"	Decompresses to standard output with gzip -cd and pipes it to grep -c to count matches	For environments where zgrep isn't available, or when you want to pass the decompressed data to another command

Explanation

To search for a string inside a gz file, you can either use zgrep or pass content decompressed with gzip -cd to grep. If you only need the count, both methods let you easily get the number of matches using the -c option.

How to also display surrounding lines when searching a gz file with grep

Create the file

cat << 'EOF' > input.txt
2024-01-01 INFO Application Start
2024-01-01 INFO Loading config
2024-01-01 ERROR Database connection failed
2024-01-01 INFO Retry connection
2024-01-01 INFO Database connection success
EOF

Create the file

gzip -c input.txt > input.txt.gz

Command to run

grep -C 1 "ERROR" <(gzip -cd input.txt.gz)

Result

2024-01-01 INFO Loading config
2024-01-01 ERROR Database connection failed
2024-01-01 INFO Retry connection

How it works

Item	Description
gzip -cd	Decompresses the gz file to standard output (-c is standard output, -d is decompress)
<(...)	Process substitution passes the decompressed result to grep as if it were a temporary file
grep -C 1	Displays 1 line before and after each matching line
"ERROR"	The string to search for
input.txt.gz	The gz file to search

Explanation

gzip -cd decompresses the gz file to standard output, and the output is passed to grep via process substitution <(...).
This lets you search including surrounding lines using a regular grep command, without decompressing the file.

How to combine grep with the find command to search gz files

Create the file

mkdir -p logs/app logs/archive

Create the file

echo "INFO: start" > logs/app/app.log

Create the file

echo "ERROR: disk full" > logs/app/error.log

Create the file

gzip logs/app/error.log

Create the file

echo "INFO: backup" > logs/archive/backup.log

Create the file

gzip logs/archive/backup.log

Command to run

find logs -name "*.gz"

Result

logs/app/error.log.gz
logs/archive/backup.log.gz

Command to run

find logs -name "*.gz" | grep "error"

Result

logs/app/error.log.gz

How it works

Mechanism	Description
find logs	Recursively searches under the logs directory
-name "*.gz"	Targets only files with the .gz extension
\|	Passes find's search results to grep
grep "error"	Extracts only .gz files whose path name contains "error"

Explanation

By searching for .gz files with find and passing the results to grep, you can efficiently narrow down to just the files you're looking for.

Even in environments with a large number of .gz files, you can quickly find the files you need.

How to search rotated log gz files with grep

Create the file

cat << 'EOF' > input.txt
2025-07-01 10:00:01 INFO Application started
2025-07-01 10:01:15 ERROR Database connection failed
2025-07-01 10:02:30 INFO Retry database connection
2025-07-01 10:03:12 ERROR Timeout occurred
EOF

Create the file

gzip -c input.txt > input.txt.gz

Command to run

zgrep "ERROR" input.txt.gz

Result

2025-07-01 10:01:15 ERROR Database connection failed
2025-07-01 10:03:12 ERROR Timeout occurred

Command to run

zgrep -n "ERROR" input.txt.gz

Result

2:2025-07-01 10:01:15 ERROR Database connection failed
4:2025-07-01 10:03:12 ERROR Timeout occurred

Command to run

zgrep -i "error" input.txt.gz

Result

2025-07-01 10:01:15 ERROR Database connection failed
2025-07-01 10:03:12 ERROR Timeout occurred

How it works

Item	Description
zgrep	Command that searches gzip-compressed (.gz) files without decompressing them
"ERROR"	Specifies the string to search for
-n	Displays the matching line number
-i	Searches without distinguishing between upper and lower case
input.txt.gz	A rotated, gzip-compressed log file

Explanation

Using zgrep lets you search rotated .gz files the same way you would with grep, without having to decompress them.
It's often used in operations settings since it makes investigating incidents and checking past logs efficient.

How to search a large number of gz files quickly with grep

Create the file

mkdir -p logs

Create the file

cat << 'LOG' > logs/app1.log
INFO Application started
ERROR Database connection failed
INFO Retry completed
LOG

Create the file

cat << 'LOG' > logs/app2.log
INFO User login
ERROR Timeout occurred
INFO Process finished
LOG

Create the file

gzip -f logs/app1.log

Create the file

gzip -f logs/app2.log

Command to run

zgrep "ERROR" logs/app1.log.gz

Result

ERROR Database connection failed

Command to run

find logs -name "*.gz" -exec zgrep -H "ERROR" {} +

Result

logs/app1.log.gz:ERROR Database connection failed
logs/app2.log.gz:ERROR Timeout occurred

How it works

Mechanism	Description
zgrep	Runs a grep search on gzip-compressed files without decompressing them.
find	Enumerates a large number of .gz files as search targets.
-H	Also displays the matching file name.
-exec {} +	Passes multiple files to zgrep at once, reducing the number of processes spawned.

Explanation

When searching gz files with grep, using zgrep instead of regular grep lets you search gzip files directly without decompressing them.

For a large number of gz files, combining find with -exec {} + lets you search them all efficiently in one go.

Common errors and solutions when searching gz files with grep

Create the file

cat << 'EOF' > input.txt
INFO Start application
ERROR Database connection failed
INFO Retry
EOF

Create the file

gzip -c input.txt > input.txt.gz

Command to run

grep "ERROR" input.txt.gz

Result

no output

Command to run

zgrep "ERROR" input.txt.gz

Result

ERROR Database connection failed

Command to run

gzip -cd input.txt.gz | grep "ERROR"

Result

ERROR Database connection failed

How it works

Command	How it works
grep "ERROR" input.txt.gz	Searches the gzip-compressed binary data as-is, so it can't search correctly as text.
zgrep "ERROR" input.txt.gz	Runs grep internally while decompressing the .gz file, so it can search the compressed file directly.
gzip -cd input.txt.gz \| grep "ERROR"	Decompresses to standard output with gzip -cd and pipes the content to grep to search it.

Explanation

Since grep can't search the contents of compressed .gz files directly, you may see messages such as "Binary file ... matches".

When searching .gz files, use zgrep, or decompress with gzip -cd first and pass the result to grep.

Key points for searching gz files with grep

To work with gz files using grep, using related commands like zgrep lets you search without decompressing them.

Make use of the commands under each heading so you can efficiently find the data you're looking for.