How to make journalctl recognize user-defined fields?How to combine output of several journals by journalctl?How do you use systemd's journalctl patternsHow to display syslog priority level in systemd's journalctlsystemd's journalctl: how to filter by message?Is there a way to make journalctl show logs from “the last time foo.service ran”?journalctl: how to display colors in its output?How to allow a user to use journalctl to see user-specific systemd service logs?How do view older journalctl logs (after a rotation maybe?)Arch Linux journalctl: how to increase logging size?Why there is no journalctl in my centos 6.6 box and how to install/enable it?
Multi tool use
When is it ok to add filler to a story?
Pull-up sequence accumulator counter
Alphabet completion rate
How many codes are possible?
What would Earth look like at night in medieval times?
Declining an offer to present a poster instead of a paper
Does ultrasonic bath cleaning damage laboratory volumetric glassware calibration?
Calculating the partial sum of a expl3 sequence
Why does adding parentheses prevent an error?
How to append a matrix element by element?
Averting Real Women Don’t Wear Dresses
Does image quality of the lens affect "focus and recompose" technique?
Cascading Repair Costs following Blown Head Gasket on a 2004 Subaru Outback
How can I repair scratches on a painted French door?
Symbolic equivalent of chmod 400
Simple object validator with a new API
How to get cool night-vision without lame drawbacks?
Why is the Turkish president's surname spelt in Russian as Эрдоган, with г?
A player is constantly pestering me about rules, what do I do as a DM?
Why is Madam Hooch not a professor?
Mount a folder with a space on Linux
C-152 carb heat on before landing in hot weather?
Why is C++ initial allocation so much larger than C's?
How come I was asked by a CBP officer why I was in the US?
How to make journalctl recognize user-defined fields?
How to combine output of several journals by journalctl?How do you use systemd's journalctl patternsHow to display syslog priority level in systemd's journalctlsystemd's journalctl: how to filter by message?Is there a way to make journalctl show logs from “the last time foo.service ran”?journalctl: how to display colors in its output?How to allow a user to use journalctl to see user-specific systemd service logs?How do view older journalctl logs (after a rotation maybe?)Arch Linux journalctl: how to increase logging size?Why there is no journalctl in my centos 6.6 box and how to install/enable it?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
Journalctl's manual says:
New fields may freely be defined by applications, but a few fields
have special meaning.
However I don't see a way to actually introduce my own field that journalctl would recognize and allow filter on.
I tried many variations of the following to no avail:
echo 'FOO=12' | systemd-cat -t TestFields -p warning
journalctl doesn't see FOO field that I'm trying to add:
# journalctl -f -t TestFields
-- Logs begin at Wed 2018-11-28 16:08:31 UTC. --
Nov 28 16:29:10 2f79ab2701c9 TestFields[105]: FOO=12
in json format:
# journalctl -f -t TestFields -o json-pretty
"__CURSOR" : "s=95d756f74cc14c25b5d6a6c86e2d3dd4;i=31b;b=c2286470c74849db84c4a2b458276561;m=4686eb5305;t=57bbc10de8aab;x=8ea14ded83dc4684",
"__REALTIME_TIMESTAMP" : "1543422550641323",
"__MONOTONIC_TIMESTAMP" : "302911279877",
"_BOOT_ID" : "c2286470c74849db84c4a2b458276561",
"_UID" : "0",
"_GID" : "0",
"_MACHINE_ID" : "70406ad7f5774a17a5f1cbbaf5f4455e",
"_HOSTNAME" : "2f79ab2701c9",
"PRIORITY" : "4",
"_CAP_EFFECTIVE" : "3fffffffff",
"_SYSTEMD_CGROUP" : "0",
"_TRANSPORT" : "stdout",
"_COMM" : "cat",
"_EXE" : "/usr/bin/cat",
"_CMDLINE" : "/bin/cat",
"_STREAM_ID" : "7bf67dfa7ff846429fea8092f40a34f7",
"SYSLOG_IDENTIFIER" : "TestFields",
"MESSAGE" : "FOO=12",
"_PID" : "105"
and finally filtering yields no result:
# journalctl FOO=12 -t TestFields
-- No entries --
for comparison:
# journalctl _PID=105 -t TestFields
-- Logs begin at Wed 2018-11-28 16:08:31 UTC, end at Wed 2018-11-28 16:29:10 UTC. --
Nov 28 16:29:10 2f79ab2701c9 TestFields[105]: FOO=12
systemd journalctl
asked Nov 28 '18 at 16:37
AlexAlex
1105 bronze badges
add a comment |
Journalctl's manual says:
New fields may freely be defined by applications, but a few fields
have special meaning.
However I don't see a way to actually introduce my own field that journalctl would recognize and allow filter on.
I tried many variations of the following to no avail:
echo 'FOO=12' | systemd-cat -t TestFields -p warning
journalctl doesn't see FOO field that I'm trying to add:
# journalctl -f -t TestFields
-- Logs begin at Wed 2018-11-28 16:08:31 UTC. --
Nov 28 16:29:10 2f79ab2701c9 TestFields[105]: FOO=12
in json format:
# journalctl -f -t TestFields -o json-pretty
"__CURSOR" : "s=95d756f74cc14c25b5d6a6c86e2d3dd4;i=31b;b=c2286470c74849db84c4a2b458276561;m=4686eb5305;t=57bbc10de8aab;x=8ea14ded83dc4684",
"__REALTIME_TIMESTAMP" : "1543422550641323",
"__MONOTONIC_TIMESTAMP" : "302911279877",
"_BOOT_ID" : "c2286470c74849db84c4a2b458276561",
"_UID" : "0",
"_GID" : "0",
"_MACHINE_ID" : "70406ad7f5774a17a5f1cbbaf5f4455e",
"_HOSTNAME" : "2f79ab2701c9",
"PRIORITY" : "4",
"_CAP_EFFECTIVE" : "3fffffffff",
"_SYSTEMD_CGROUP" : "0",
"_TRANSPORT" : "stdout",
"_COMM" : "cat",
"_EXE" : "/usr/bin/cat",
"_CMDLINE" : "/bin/cat",
"_STREAM_ID" : "7bf67dfa7ff846429fea8092f40a34f7",
"SYSLOG_IDENTIFIER" : "TestFields",
"MESSAGE" : "FOO=12",
"_PID" : "105"
and finally filtering yields no result:
# journalctl FOO=12 -t TestFields
-- No entries --
for comparison:
# journalctl _PID=105 -t TestFields
-- Logs begin at Wed 2018-11-28 16:08:31 UTC, end at Wed 2018-11-28 16:29:10 UTC. --
Nov 28 16:29:10 2f79ab2701c9 TestFields[105]: FOO=12
systemd journalctl
asked Nov 28 '18 at 16:37
AlexAlex
1105 bronze badges
add a comment |
Journalctl's manual says:
New fields may freely be defined by applications, but a few fields
have special meaning.
However I don't see a way to actually introduce my own field that journalctl would recognize and allow filter on.
I tried many variations of the following to no avail:
echo 'FOO=12' | systemd-cat -t TestFields -p warning
journalctl doesn't see FOO field that I'm trying to add:
# journalctl -f -t TestFields
-- Logs begin at Wed 2018-11-28 16:08:31 UTC. --
Nov 28 16:29:10 2f79ab2701c9 TestFields[105]: FOO=12
in json format:
# journalctl -f -t TestFields -o json-pretty
"__CURSOR" : "s=95d756f74cc14c25b5d6a6c86e2d3dd4;i=31b;b=c2286470c74849db84c4a2b458276561;m=4686eb5305;t=57bbc10de8aab;x=8ea14ded83dc4684",
"__REALTIME_TIMESTAMP" : "1543422550641323",
"__MONOTONIC_TIMESTAMP" : "302911279877",
"_BOOT_ID" : "c2286470c74849db84c4a2b458276561",
"_UID" : "0",
"_GID" : "0",
"_MACHINE_ID" : "70406ad7f5774a17a5f1cbbaf5f4455e",
"_HOSTNAME" : "2f79ab2701c9",
"PRIORITY" : "4",
"_CAP_EFFECTIVE" : "3fffffffff",
"_SYSTEMD_CGROUP" : "0",
"_TRANSPORT" : "stdout",
"_COMM" : "cat",
"_EXE" : "/usr/bin/cat",
"_CMDLINE" : "/bin/cat",
"_STREAM_ID" : "7bf67dfa7ff846429fea8092f40a34f7",
"SYSLOG_IDENTIFIER" : "TestFields",
"MESSAGE" : "FOO=12",
"_PID" : "105"
and finally filtering yields no result:
# journalctl FOO=12 -t TestFields
-- No entries --
for comparison:
# journalctl _PID=105 -t TestFields
-- Logs begin at Wed 2018-11-28 16:08:31 UTC, end at Wed 2018-11-28 16:29:10 UTC. --
Nov 28 16:29:10 2f79ab2701c9 TestFields[105]: FOO=12
systemd journalctl
asked Nov 28 '18 at 16:37
AlexAlex
1105 bronze badges
Journalctl's manual says:
New fields may freely be defined by applications, but a few fields
have special meaning.
However I don't see a way to actually introduce my own field that journalctl would recognize and allow filter on.
I tried many variations of the following to no avail:
echo 'FOO=12' | systemd-cat -t TestFields -p warning
journalctl doesn't see FOO field that I'm trying to add:
# journalctl -f -t TestFields
-- Logs begin at Wed 2018-11-28 16:08:31 UTC. --
Nov 28 16:29:10 2f79ab2701c9 TestFields[105]: FOO=12
in json format:
# journalctl -f -t TestFields -o json-pretty
"__CURSOR" : "s=95d756f74cc14c25b5d6a6c86e2d3dd4;i=31b;b=c2286470c74849db84c4a2b458276561;m=4686eb5305;t=57bbc10de8aab;x=8ea14ded83dc4684",
"__REALTIME_TIMESTAMP" : "1543422550641323",
"__MONOTONIC_TIMESTAMP" : "302911279877",
"_BOOT_ID" : "c2286470c74849db84c4a2b458276561",
"_UID" : "0",
"_GID" : "0",
"_MACHINE_ID" : "70406ad7f5774a17a5f1cbbaf5f4455e",
"_HOSTNAME" : "2f79ab2701c9",
"PRIORITY" : "4",
"_CAP_EFFECTIVE" : "3fffffffff",
"_SYSTEMD_CGROUP" : "0",
"_TRANSPORT" : "stdout",
"_COMM" : "cat",
"_EXE" : "/usr/bin/cat",
"_CMDLINE" : "/bin/cat",
"_STREAM_ID" : "7bf67dfa7ff846429fea8092f40a34f7",
"SYSLOG_IDENTIFIER" : "TestFields",
"MESSAGE" : "FOO=12",
"_PID" : "105"
and finally filtering yields no result:
# journalctl FOO=12 -t TestFields
-- No entries --
for comparison:
# journalctl _PID=105 -t TestFields
-- Logs begin at Wed 2018-11-28 16:08:31 UTC, end at Wed 2018-11-28 16:29:10 UTC. --
Nov 28 16:29:10 2f79ab2701c9 TestFields[105]: FOO=12
systemd journalctl
systemd journalctl
asked Nov 28 '18 at 16:37
AlexAlex
1105 bronze badges
asked Nov 28 '18 at 16:37
AlexAlex
1105 bronze badges
asked Nov 28 '18 at 16:37
AlexAlex
1105 bronze badges
asked Nov 28 '18 at 16:37
AlexAlex
1105 bronze badges
asked Nov 28 '18 at 16:37
AlexAlex
1105 bronze badges
1105 bronze badges
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
In case someone is exploring this path, the answer is no, you can't do that. Consider using structured logs where you can add whatever fields you want.
answered Jun 9 at 2:27
AlexAlex
1105 bronze badges
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f942019%2fhow-to-make-journalctl-recognize-user-defined-fields%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
In case someone is exploring this path, the answer is no, you can't do that. Consider using structured logs where you can add whatever fields you want.
answered Jun 9 at 2:27
AlexAlex
1105 bronze badges
add a comment |
In case someone is exploring this path, the answer is no, you can't do that. Consider using structured logs where you can add whatever fields you want.
answered Jun 9 at 2:27
AlexAlex
1105 bronze badges
add a comment |
In case someone is exploring this path, the answer is no, you can't do that. Consider using structured logs where you can add whatever fields you want.
answered Jun 9 at 2:27
AlexAlex
1105 bronze badges
In case someone is exploring this path, the answer is no, you can't do that. Consider using structured logs where you can add whatever fields you want.
answered Jun 9 at 2:27
AlexAlex
1105 bronze badges
answered Jun 9 at 2:27
AlexAlex
1105 bronze badges
answered Jun 9 at 2:27
AlexAlex
1105 bronze badges
answered Jun 9 at 2:27
AlexAlex
1105 bronze badges
1105 bronze badges
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f942019%2fhow-to-make-journalctl-recognize-user-defined-fields%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
5Kbc,eMyFzeXCkIj,TFN4hSh1,OisBkGDLMKRWJGMfZd9UmOS,xvC1hqpZNLo2y0,n8TZyttV,5yVYXhI s7XGbyAT
