I'm trying to get the last few lines from journalctl so I can feed them into my conky. However journalctl by default provides too much crap that wastes space: With journalctl -u PROCESS -n 5 --no-pager -l I get entries like:


I want to print only TIME MESSAGE. How can I do that?

The manpage says there's an -o argument, but there's no predefined format that fits my need. I tried adding --output-fields=__REALTIME_TIMESTAMP,MESSAGE but that just shows the default output (and not timestamp/message). That argument claims only some formats are affected, so I tried --output-fields=__REALTIME_TIMESTAMP,MESSAGE -o verbose but that only gives me the normal vebose output. Besides, apparently there's 4 fields that are always printed, which is already too many for me. I want just 2: a compact timestamp and the message.

I could use some bash magic or a python script to clean it up, but that seems a bit excessive. Surely there's a way to ask journalctl to give me just a timestamp and message?

  • 3
    3 years later, trying to achieve the same behaviour. The --output-fields option is just ignored. Have you solved the issue?
    – Maximko
    Oct 6 '20 at 8:36
  • @Maximko , have you tried --output="json" --output-fields="MESSAGE", i.e. specifying output explicitly? It works for me where without, --output-fields is indeed ignored. The docs read: Select fields to print in verbose/export/json modes. The default is short, so it doesn't work there.
    – Alex Povel
    Mar 23 at 20:13
  • I solved the issue using python bindings for systemd, and periodically generating a text file which contains the last 20 lines from journald, formatted as I need (including colored fields, etc.) with conky syntax. I then just read periodically this file in conky.
    – Maximko
    Mar 24 at 8:54

This seems to have been implemented in 2018, see this PR. With version 236 and above it looks like you can use --output-fields=, described in --help. Check your version with systemctl --version, my CentOS 7 currently (in 2019) runs version 219 so this will probably take some time to make it out to most environments.

edit: FYI EL8 (as of 2021-04-12) runs systemd 239, so this is available.


journalctl --output cat

               generates a very terse output, only showing the actual message of each journal entry with no metadata, not even a timestamp. If combined with the --output-fields= option will output the listed fields for each log
               record, instead of the message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.