time difference to the previous entry. Maybe unreliable time differences are marked by a "*".
short-unix
is very similar, but shows seconds passed since January 1st 1970 UTC instead of wallclock timestamps ("UNIX time"). The time is shown with microsecond accuracy.
verbose
shows the full-structured entry items with all fields.
export
serializes the journal into a binary (but mostly text-based) stream suitable for backups and network transfer (see Journal Export Format[2] for more information). To import the binary stream back into native
journald format use systemd‐journal‐remote(8).
json
formats entries as JSON objects, separated by newline characters (see Journal JSON Format[3] for more information). Field values are generally encoded as JSON strings, with three exceptions:
1. Fields larger than 4096 bytes are encoded as null values. (This may be turned off by passing --all, but be aware that this may allocate overly long JSON objects.)
2. Journal entries permit non-unique fields within the same log entry. JSON does not allow non-unique fields within objects. Due to this, if a non-unique field is encountered a JSON array is used as field
value, listing all field values as elements.
3. Fields containing non-printable or non-UTF8 bytes are encoded as arrays containing the raw bytes individually formatted as unsigned numbers.
Note that this encoding is reversible (with the exception of the size limit).
json-pretty
formats entries as JSON data structures, but formats them in multiple lines in order to make them more readable by humans.
json-sse
formats entries as JSON data structures, but wraps them in a format suitable for Server-Sent Events[4].
json-seq
formats entries as JSON data structures, but prefixes them with an ASCII Record Separator character (0x1E) and suffixes them with an ASCII Line Feed character (0x0A), in accordance with JavaScript Object
Notation (JSON) Text Sequences[5] ("application/json-seq").
cat
generates a very terse output, only showing the actual message of each journal entry with no metadata, not even a timestamp. If combined with the --output-fields= option will output the listed fields for each
log record, instead of the message.
with-unit
similar to short-full, but prefixes the unit and user unit names instead of the traditional syslog identifier. Useful when using templated instances, as it will include the arguments in the unit names.
--output-fields=
A comma separated list of the fields which should be included in the output. This has an effect only for the output modes which would normally show all fields (verbose, export, json, json-pretty, json-sse and
json-seq), as well as on cat. For the former, the "__CURSOR", "__REALTIME_TIMESTAMP", "__MONOTONIC_TIMESTAMP", and "_BOOT_ID" fields are always printed.
-n, --lines=
Show the most recent journal events and limit the number of events shown. If --follow is used, this option is implied. The argument is a positive integer or "all" to disable line limiting. The default value is 10
if no argument is given.
When used with --grep=, --reverse is implied.
-r, --reverse
Reverse output so that the newest entries are displayed first.
--show-cursor
The cursor is shown after the last entry after two dashes:
-- cursor: s=0639...
The format of the cursor is private and subject to change.
--utc
Express time in Coordinated Universal Time (UTC).
-x, --catalog
Augment log lines with explanation texts from the message catalog.