Print only timestamp and message in journalctl

Question

I'm trying to get the last few lines from journalctl so I can feed them into my conky. However journalctl by default provides too much crap that wastes space: With journalctl -u PROCESS -n 5 --no-pager -l I get entries like:

DATE TIME HOSTNAME PROCESS: MESSAGE

I want to print only TIME MESSAGE. How can I do that?

---

The manpage says there's an -o argument, but there's no predefined format that fits my need. I tried adding --output-fields=__REALTIME_TIMESTAMP,MESSAGE but that just shows the default output (and not timestamp/message). That argument claims only some formats are affected, so I tried --output-fields=__REALTIME_TIMESTAMP,MESSAGE -o verbose but that only gives me the normal vebose output. Besides, apparently there's 4 fields that are always printed, which is already too many for me. I want just 2: a compact timestamp and the message.

I could use some bash magic or a python script to clean it up, but that seems a bit excessive. Surely there's a way to ask journalctl to give me just a timestamp and message?

Solution 1

This seems to have been implemented in 2018, see this PR. With version 236 and above it looks like you can use --output-fields=, described in --help. Check your version with systemctl --version, my CentOS 7 currently (in 2019) runs version 219 so this will probably take some time to make it out to most environments.

edit: FYI EL8 (as of 2021-04-12) runs systemd 239, so this is available.

Solution 2

journalctl --output cat

cat
               generates a very terse output, only showing the actual message of each journal entry with no metadata, not even a timestamp. If combined with the --output-fields= option will output the listed fields for each log
               record, instead of the message.

Comments

[Maximko]

3 years later, trying to achieve the same behaviour. The --output-fields option is just ignored. Have you solved the issue?

[Alex Povel]

@Maximko , have you tried --output="json" --output-fields="MESSAGE", i.e. specifying output explicitly? It works for me where without, --output-fields is indeed ignored. The docs read: Select fields to print in verbose/export/json modes. The default is short, so it doesn't work there.

[Maximko]

I solved the issue using python bindings for systemd, and periodically generating a text file which contains the last 20 lines from journald, formatted as I need (including colored fields, etc.) with conky syntax. I then just read periodically this file in conky.