I'm trying to get the last few lines from journalctl so I can feed them into my conky. However journalctl by default provides too much crap that wastes space: With journalctl -u PROCESS -n 5 --no-pager -l I get entries like:


I want to print only TIME MESSAGE. How can I do that?

The manpage says there's an -o argument, but there's no predefined format that fits my need. I tried adding --output-fields=__REALTIME_TIMESTAMP,MESSAGE but that just shows the default output (and not timestamp/message). That argument claims only some formats are affected, so I tried --output-fields=__REALTIME_TIMESTAMP,MESSAGE -o verbose but that only gives me the normal vebose output. Besides, apparently there's 4 fields that are always printed, which is already too many for me. I want just 2: a compact timestamp and the message.

I could use some bash magic or a python script to clean it up, but that seems a bit excessive. Surely there's a way to ask journalctl to give me just a timestamp and message?

  • 2
    No. There's no way to do that with journalctl alone (unless you patch the source code). You can get just the messages via -o cat. If you want the timestamps too you'll have to output to json and pipe that to jq to extract the stuff you need e.g. journalctl -b -o json | jq -r '"\((.__REALTIME_TIMESTAMP | tonumber) / 1000000 | todate) \(.MESSAGE)"' – don_crissti Jan 20 '18 at 20:27
  • 1
    @don_crissti Jesus, really? Is there some design reason for this, or just nobody bothered implementing it? – Bagalaw Jan 21 '18 at 2:24
  • lol... No, quite the opposite... in fact, what you describe in your post above (the 4 fields that are always printed) is the actual implementation of a very similar request... – don_crissti Jan 21 '18 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.