How do i display the output of systemd journalctl in json?

  • Man page for journalctl.

    Output in json one line.

    $ journalctl -u postfix.service -o json
    { "__CURSOR" : "s=50dd9f837d0443828a9615806689fafd;i=ed;b=be3520dd2daf4ec4b24ce31885d8de37;m=38c62a7;t=5
    { "__CURSOR" : "s=50dd9f837d0443828a9615806689fafd;i=102;b=be3520dd2daf4ec4b24ce31885d8de37;m=39db7d4;t=
    { "__CURSOR" : "s=50dd9f837d0443828a9615806689fafd;i=103;b=be3520dd2daf4ec4b24ce3

    Output in json over multiple lines, know as json-pretty.

    $ journalctl -u postfix.service -o json-pretty
            "__CURSOR" : "s=50dd9f837d0443828a9615806689fafd;i=ed;b=be3520dd2daf4ec4b24ce31885d8de37;m=38c62
            "__REALTIME_TIMESTAMP" : "1549192590410951",
            "__MONOTONIC_TIMESTAMP" : "59531943",
            "_BOOT_ID" : "be3520dd2daf4ec4b24ce31885d8de37",
            "PRIORITY" : "6",
            "_UID" : "0",
            "_GID" : "0",
            "_MACHINE_ID" : "6dee5c9f241a493fb69d3d375c4d59fa",
            "SYSLOG_FACILITY" : "3",
            "SYSLOG_IDENTIFIER" : "systemd",
            "_TRANSPORT" : "journal",
            "_PID" : "1",
            "_COMM" : "systemd",

    Other output formats from Man page.

           -o, --output=
               Controls the formatting of the journal entries that are shown. Takes one of the following
                   is the default and generates an output that is mostly identical to the formatting of
                   classic syslog files, showing one line per journal entry.
                   is very similar, but shows ISO 8601 wallclock timestamps.
                   is very similar, but shows timestamps with full microsecond precision.
                   is very similar, but shows monotonic timestamps instead of wallclock timestamps.
                   shows the full-structured entry items with all fields.
                   serializes the journal into a binary (but mostly text-based) stream suitable for
                   backups and network transfer (see Journal Export Format[1] for more information).
                   formats entries as JSON data structures, one per line (see Journal JSON Format[2] for
                   more information).
                   formats entries as JSON data structures, but formats them in multiple lines in order
                   to make them more readable by humans.
                   formats entries as JSON data structures, but wraps them in a format suitable for
                   Server-Sent Events[3].
                   generates a very terse output, only showing the actual message of each journal entry
                   with no metadata, not even a timestamp.

Log in to reply

© Lightnetics 2019