Project selected fields as columns journalctl

Trim JSON to needed fields then tab-format; __REALTIME_TIMESTAMP is microseconds

journalctl -u <name> --output=json --output-fields=__REALTIME_TIMESTAMP,MESSAGE,_PID | jq -r '[.__REALTIME_TIMESTAMP,._PID,.MESSAGE]|@tsv'

#journalctl #observability #debug

more journalctl all 12 commands →

Merge journals from a directory journalctl -D /mnt/crashed/var/log/journal -b -1 -p err Verify persistent storage is enabled journalctl --header | grep -iE 'file|state'; ls -d /var/log/journal 2>/dev/null || echo volatile Filter by priority error and above journalctl -p err -b --no-pager Match by raw systemd unit field journalctl _SYSTEMD_UNIT=sshd.service --since today Combine field filters with OR journalctl _PID=1 + _COMM=sshd -o short-iso