specified multiple times.
-p, --priority=
Filter output by message priorities or priority ranges. Takes either a single numeric or textual log level (i.e. between 0/"emerg" and 7/"debug"), or a range of numeric/text log levels in the form FROM..TO. The
log levels are the usual syslog log levels as documented in syslog(3), i.e. "emerg" (0), "alert" (1), "crit" (2), "err" (3), "warning" (4), "notice" (5), "info" (6), "debug" (7). If a single log level is
specified, all messages with this log level or a lower (hence more important) log level are shown. If a range is specified, all messages within the range are shown, including both the start and the end value of
the range. This will add "PRIORITY=" matches for the specified priorities.
--facility=
Filter output by syslog facility. Takes a comma-separated list of numbers or facility names. The names are the usual syslog facilities as documented in syslog(3). --facility=help may be used to display a list of
known facility names and exit.
-g, --grep=
Filter output to entries where the MESSAGE= field matches the specified regular expression. PERL-compatible regular expressions are used, see pcre2pattern(3) for a detailed description of the syntax.
If the pattern is all lowercase, matching is case insensitive. Otherwise, matching is case sensitive. This can be overridden with the --case-sensitive option, see below.
When used with --lines=, --reverse is implied.
--case-sensitive[=BOOLEAN]
Make pattern matching case sensitive or case insensitive.
-k, --dmesg
Show only kernel messages. This implies -b and adds the match "_TRANSPORT=kernel".
OUTPUT OPTIONS
The following options control how journal records are printed:
-o, --output=
Controls the formatting of the journal entries that are shown. Takes one of the following options:
short
is the default and generates an output that is mostly identical to the formatting of classic syslog files, showing one line per journal entry.
short-full
is very similar, but shows timestamps in the format the --since= and --until= options accept. Unlike the timestamp information shown in short output mode this mode includes weekday, year and timezone
information in the output, and is locale-independent.
short-iso
is very similar, but shows ISO 8601 wallclock timestamps.
short-iso-precise
as for short-iso but includes full microsecond precision.
short-precise
is very similar, but shows classic syslog timestamps with full microsecond precision.
short-monotonic
is very similar, but shows monotonic timestamps instead of wallclock timestamps.
short-delta
as for short-monotonic but includes the time difference to the previous entry. Maybe unreliable time differences are marked by a "*".
short-unix
is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock timestamps ("UNIX time"). The time is shown with microsecond accuracy.
verbose
shows the full-structured entry items with all fields.
export
serializes the journal into a binary (but mostly text-based) stream suitable for backups and network transfer (see Journal Export Format[2] for more information). To import the binary stream back into native
journald format use systemd‐journal‐remote(8).
json
formats entries as JSON objects, separated by newline characters (see Journal JSON Format[3] for more information). Field values are generally encoded as JSON strings, with three exceptions:
1. Fields larger than 4096 bytes are encoded as null values. (This may be