sed substitution

s/REGEX/REPLACEMENT/FLAGS is the core sed command. The / characters are delimiters — you can use any character in their place, which is useful when the pattern contains slashes.

echo "hello world" | sed 's/world/earth/'
# hello earth

Without any flags, s replaces only the first match on each line.

The g flag replaces all matches on the line.

echo "aaa bbb aaa" | sed 's/aaa/zzz/g'
# zzz bbb zzz

Without g, only the first aaa would become zzz.

Alternate delimiter: When the pattern contains /, use a different delimiter to avoid escaping.

sed 's|/old/path|/new/path|g' config.txt

Using | as the delimiter. Any non-alphanumeric character works: s#old#new#g, s,old,new,g.

Addresses restrict which lines receive the command. Without an address, a command applies to every line.

• N — line number: 3s/old/new/ applies only to line 3.
• $ — last line: $d deletes only the last line.
• /REGEX/ — lines matching a pattern: /^#/d deletes comment lines.
• N,M — line range: 2,5s/foo/bar/ edits lines 2 through 5.
• /START/,/END/ — range between two patterns: /BEGIN/,/END/s/x/y/ edits lines from the first match of BEGIN to the next match of END.

# Replace only in lines 10 through 20
sed '10,20s/debug/info/g' app.log

# Replace only in lines that contain 'ERROR'
sed '/ERROR/s/localhost/prod-server/g' config.log

Address + command is a powerful combination: you can make surgical changes without touching lines that look similar but are in the wrong section.

The d command deletes lines. Combined with an address, it removes specific lines from the output.

# Delete all comment lines (starting with #)
sed '/^#/d' nginx.conf

# Delete blank lines
sed '/^[[:space:]]*$/d' file.txt

# Delete lines 1 through 5 (e.g. a CSV header + metadata)
sed '1,5d' report.csv

# Delete the last line
sed '$d' file.txt

d prints nothing for the matched line and immediately moves to the next line — no further commands run on a deleted line.

Negation with !: addr!cmd applies cmd to lines that do NOT match the address.

# Keep only lines containing 'ERROR' (delete everything else)
sed '/ERROR/!d' app.log

This is equivalent to grep 'ERROR' but demonstrates sed’s address system.

-i edits files in-place. Instead of printing to stdout, sed -i rewrites the file directly. This is essential for scripted config management and mass rename operations.

# GNU sed (Linux)
sed -i 's/old_hostname/new_hostname/g' /etc/hosts

# Rename across multiple files at once
sed -i 's/deprecated_func/new_func/g' src/*.py

Always test without -i first — pipe to stdout and visually verify the substitution before modifying files.

-i supports an optional backup suffix: sed -i.bak 's/old/new/g' file saves the original as file.bak. Without a suffix (GNU sed) or with an empty string suffix (BSD sed), no backup is made.

Capture groups with \(...\) and backreferences \1. Standard sed uses BRE (Basic Regular Expressions) where group syntax is \(...\) and backreferences are \1, \2.

# Swap first and second colon-separated fields
echo "alice:admin" | sed 's/\([^:]*\):\([^:]*\)/\2:\1/'
# admin:alice

\([^:]*\) captures “everything up to the colon” as group 1. \([^:]*\) captures the second field as group 2. The replacement \2:\1 swaps them.

For extended regex with cleaner syntax (+, ?, |, groups without backslash), use -E:

echo "2025-06-19" | sed -E 's/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3\/\2\/\1/'
# 19/06/2025