Even though it's a faux pas, I find it logically makes more sense to me. Consider a pipeline like cat *.log | grep "apache" | grep -v "1.1.1.1" | wc -l

Even though it's a faux pas, I find it logically makes more sense to me. Consider a pipeline like cat *.log | grep "apache" | grep -v "1.1.1.1" | wc -l It makes sense in that order. Read the file, grep this, exclude that, could the total. Meanwhile grep "apache" *.log | grep -v "1.1.1.1" | wc -l may be a few characters shorter but the order isn't really logical anymore.