What the Pipe Symbol Actually Does in Linux and Why It Changes Everything

One vertical bar connects two commands together in a way that makes both more powerful than either could be alone

Photo by Gowtham AGM on Unsplash

At some point you copied a command from somewhere that had a vertical bar in the middle of it.

ps aux | grep firefox

It worked. You got your result. But if someone asked you to explain what that vertical bar actually did, the honest answer was probably something vague about connecting commands together.

The pipe symbol is one of the most powerful ideas in Linux. Once you understand what it actually does, you start seeing opportunities to use it everywhere, and you stop copying commands blindly and start building your own.

What the pipe symbol does in Linux

The pipe symbol | takes the output of the command on its left and feeds it directly as input to the command on its right.

That’s the whole idea. Output becomes input.

Without a pipe, a command prints its results to your screen and stops. With a pipe, instead of printing to your screen, that output travels directly into the next command for further processing.

ls /etc | less

ls /etc lists every file in the /etc directory. On most systems that's over two hundred files, more than fits on one screen. Without the pipe, that list floods past and you lose the top before you can read it. With the pipe, the output of ls feeds into less, which gives you a scrollable view you can navigate at your own pace.

Two commands. One pipe. A completely different experience.

Building your first useful pipe

The most common pipe combination every Linux user reaches for eventually is command | grep.

ps aux | grep firefox

ps aux lists every running process on your system, which is usually hundreds of lines. grep firefox filters that list down to only the lines containing the word "firefox." The pipe connects them so you see only what you're looking for instead of scrolling through everything.

The same pattern works for anything that produces a lot of output.

cat /var/log/syslog | grep error

ls -la | grep ".pdf"

history | grep "sudo apt"

In every case the logic is identical. First command produces output. Pipe sends it to the second. Second command filters, transforms, or processes it.

Chaining multiple pipes together

A pipe doesn’t have to stop at one. You can chain as many as you need, each one taking the output of the previous command and passing it further along.

cat /var/log/syslog | grep error | sort | uniq

This reads the log file, filters for lines containing “error,” sorts them alphabetically, then removes duplicate lines. Four commands connected by three pipes, each one refining the output further.

ps aux | grep firefox | awk '{print $2}'

This finds firefox processes and extracts just the process ID column from each matching line. Pipe one filters. Pipe two extracts exactly the field you want.

The power compounds with each additional pipe because each stage can focus on one thing, and the combination handles complexity that any single command would struggle with alone.

Common pipe combinations worth knowing

Count how many times something appears

cat access.log | grep "404" | wc -l

Filters log entries for 404 errors, then counts how many lines matched. wc -l counts lines.

Sort and show the most common items

cat access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -10

Extracts the first column, sorts it, counts occurrences of each unique value, sorts by count in reverse order, and shows the top ten. This is how you find the ten IP addresses hitting your server most frequently.

Find the largest files in a directory

ls -lh | sort -rh | head -10

Lists files with sizes, sorts by size largest first, shows only the top ten.

Search for a running process and get its ID immediately

ps aux | grep python3 | awk '{print $2}'

Check how many files are in a directory

ls | wc -l

Why this idea is so powerful

Most Linux commands are designed to do one thing well. grep searches. sort sorts. wc counts. awk extracts fields. head shows the first lines. tail shows the last lines. None of them are particularly impressive on their own.

The pipe is what makes them collectively capable of handling almost anything. You build complexity by combining simplicity. Each command stays focused on one job and the pipe handles the connections between them.

This is actually a core Unix design philosophy called “do one thing and do it well.” Commands are intentionally kept small and focused because the pipe makes combining them trivial. The power lives in the connections, not in any individual command.

The difference between a pipe and just running two commands

When you run two commands separately, the second one has no idea what the first one produced. You’d have to save the first command’s output to a file, then point the second command at that file.

ps aux > processes.txt
grep firefox processes.txt

The pipe skips the file entirely. Output flows directly from one command to the next, in memory, without touching the disk. Faster, cleaner, and no temporary file to clean up afterward.

What to try right now

Open your terminal and run this.

history | grep "ls" | wc -l

It counts how many times you’ve run a command containing “ls” in your terminal history. Three commands connected by two pipes, each one doing one simple thing, the combination producing something none of them could do alone.

That’s the pipe symbol. One character. Unlimited combinations.

Thanks for reading! I left a six-figure smart contract auditing career to learn Linux, Python, and AI engineering from scratch. I share my raw learning updates and one actionable terminal trick every Wednesday in my newsletter, Terminal to AI. **Join the journey for free here.**