Distinguishing levels in journalctl

Question

Can I somehow make journalctl print log levels next to actual messages?

I have found the -p option but that is not what I'm looking for, I want to see both errors and warnings but I want to be able to tell them apart.

The only thing I have found is this from man journalctl:

When outputting to a tty, lines are colored according to priority: lines of level ERROR and higher are colored red; lines of level NOTICE and higher are highlighted; other lines are displayed normally.

This is nice start, but I would still like to tell apart all 8 levels, not aggregate them in just three.

Solution

The one option is to use output formatting options. For example journalctl -o verbose will show you all data connected to a particular entry. Example:

Wed 2017-02-08 21:06:27.524361 EET [s=f689734c6c674cfd98a49e66c3349fdd;i=42c;b=01111969442644239da701153bd49c37;m=23e9195;t=548098fc53333;x=c943c53e7411726]
    PRIORITY=6
    SYSLOG_FACILITY=3
    CODE_FILE=src/core/job.c
    CODE_LINE=804
    CODE_FUNCTION=job_log_status_message
    SYSLOG_IDENTIFIER=systemd
    MESSAGE_ID=39f53479d3a045ac8e11786248231fbf
    USER_UNIT=timers.target
    MESSAGE=Reached target Timers.
    RESULT=done
    _TRANSPORT=journal
    _PID=874
    _UID=1000
    _GID=1000
    _COMM=systemd
    _EXE=/usr/lib/systemd/systemd
    _CMDLINE=/usr/lib/systemd/systemd --user
    _CAP_EFFECTIVE=0
    _SYSTEMD_CGROUP=/user.slice/user-1000.slice/[email protected]/init.scope
    _SYSTEMD_OWNER_UID=1000
    [email protected]
    _SYSTEMD_USER_UNIT=init.scope
    _SYSTEMD_SLICE=user-1000.slice
    _SYSTEMD_USER_SLICE=-.slice
    _SYSTEMD_INVOCATION_ID=2f397502a38947d5b18eca7eb5f5b1ba
    _SOURCE_REALTIME_TIMESTAMP=1486580787524361
    _BOOT_ID=01111969442644239da701153bd49c37
    _MACHINE_ID=4de8a7d0aad84611b2e1dfb0ff8f43e7
    _HOSTNAME=dracula

Here field PRIORITY actually points to a message level (in this particular case it's INFO level). Levels map in this way:

0: emerg
1: alert
2: crit
3: err
4: warning
5: notice
6: info
7: debug

I don't think you can avoid other metadata and only leave message level (correct me if I'm wrong) without some kind of post-processing (custom shell script etc).

Comments

[ddnomad]

See an answer to this question as well: serverfault.com/questions/740081/…

[Ordoshsen]

I feared I would have to write scripts for it if I really wanted it, but this actually simplifies things a lot. It just seems weird that there is no particular order of the fields and some messages have it differently

[ddnomad]

@Ordoshsen I guess some fields are optional and so on. Yes, after your question I also wonder why it's not a simple flag or something.

[don_crissti]

@Ordoshsen - not on a systemd machine right now but anyway... I'd use something like journalctl -b -o json | jq ... i.e. use json output and pipe that to jq to extract only the stuff you need (like PRIORITY, TIMESTAMP, MESSAGE). I guess you could also try to do it via python-systemd

[Matthias Braun]

Building on @don_crissti's comment, the following prints the priority level, command, time, and the message: journalctl --boot -o json | jq -r '"Priority: " + .PRIORITY + " on " + .SYSLOG_TIMESTAMP + "command: " + ._CMDLINE + ": " + .MESSAGE'