Combine field filters with OR

A bare + is a logical OR between match groups; same-field matches within a group are OR'd too

journalctl _PID=1 + _COMM=sshd -o short-iso

More journalctl commands

Regex grep across messages

journalctl --grep='oom|out of memory' --case-sensitive=false -b

PCRE2 match on MESSAGE; pair with -p err to narrow noise. note: scans, not indexed
Verbose output with all fields

journalctl -u <name> -o verbose -n 1

Dumps every journal field incl. cursor for an entry; -o json-pretty for machine parsing
List boots and read previous boot

journalctl --list-boots && journalctl -b -1 -p warning

Index past boots, then -b -1 reads the prior boot. note: needs persistent storage
Kernel ring buffer with timestamps

journalctl -k -b -o short-precise --grep='segfault|I/O error'

Like dmesg but with real wall-clock and boot filtering; -k means _TRANSPORT=kernel
Disk usage and vacuum by size/time

journalctl --disk-usage; journalctl --vacuum-size=500M --vacuum-time=2d

Show on-disk size, then prune to 500M and drop entries older than 2 days