Programming

1. chunk_size := file_size / cpu_cores. Compile regex.

2. spawn cpu_cores workers:
   2.a. worker #n starts at n * chunk_size bytes. If n > 0, skip bytes until newline encountered.
   2.b worker starts feeding bytes from file/chunk into regex. When match is found, write to output (stdout or file, whichever has better performance). When newline encountered, restart regex state automata.
   2.c after having read chunk_size bytes, continue until encountering a newline to ensure the whole file is covered by the parallel search.

Optionally, keep track of byte number and attach them to the found matches when outputting, to facilitate eventually de-duplicating and/or navigating to said match in the file.

To avoid problems, have each worker output to a separate file, and only combine these output files when the workers are all finished.

As others have said, it's going to be hard to get more speedup than this, and you will ultimately be limited by your storage's read speed and throughput if the whole file cannot fit into memory.

Read the JSONL into a real database like Postgres.

If you're writing a program, definitely multiple threads or processes that each scan a chunk of the file, which basically means seek to the start of the chunk, read lines into the scan code until you hit the end of the chunk. For jsonl each chunk will need an alignment step to not break the jsonl.

For command line trickery, maybe the file could be chunked up by running multiple dd instances with an offset parameter piped into grep. This has many synchronization issues and all the outputs should be captured separately then combined afterwards. I can't think of a good way to align this method to line edges but maybe you can put some fancy regular expression magic into the grep step to ignore malformed json at the beginning and end and overlap the chunks?

Grep is fast already, maybe test the simple approach and see how long it takes.

1. How many grep-like ops per file?
2. Is it interactive or run by another process?
3. Do you know which files ahead of time?
4. Do you have any control over that file creation?
5. Is the JSONL append only? Is the grep running while the file is modified?
6. How large is very large? 100s of MB? Few GB? 100s of GB? Whether or not it fits in memory could change the approach.
7. You're using files, plural, would parallelizing at the file level (e.g. one thread per file) be enough?
8. How many files and how often is that executed?

Splitting file in equal parts and analyzing in threads is basically the only efficient option to utilize modern CPU architectures efficiently. Since I doubt that the data stored in your files can be quickly processed by the GPU(I assume that you have text data).

How large is very large? Would it be something that jq can’t do? Is it purely string search or JSON-tree search?

Generally you would want to get file size, split it into ranges which can be read as valid UTF-8. Feed each range into reader thread. Can be inefficient for HDDs because each thread will try to access random location on disk forcing needle to jump back and forth. Also you’ll need reread ranges at split point with some positive and negative offset in case desired content got split. Things are getting much more complicated if you want JSON-tree grep. Branches may get split from parent nodes across multiple ranges.

The question is, what will be your limiting factor: CPU or disk I/O? Parallel processing doesn't do much good if the workers have to wait on the disk to deliver more data. I'd start with an async architecture, where the program can do its processing while it is waiting on more data.

Bad idea. First, file is read sequentially, and you can't parallelize this. Second, grep is a bad solution for structured files. Better use jq or something similar.