Sample Header Ad - 728x90

In journalctl internal grep, is it possible to specify option to only output matched pattern?

4 votes
0 answers
5327 views
I have the following journal messages:
$ journalctl _COMM=kwin_wayland -o cat --since "-10s"
...
kwin_screencast: Dropping a screencast frame because the compositor is slow
kwin_screencast: Dropping a screencast frame because the compositor is slow
js: hello
goodbue
kwin_screencast: Dropping a screencast frame because the compositor is slow
kwin_screencast: Dropping a screencast frame because the compositor is slow
...
I want to extract only messages starting with "js: ". From journalctl manual: > -g, --grep=
>Filter output to entries where the MESSAGE= field matches the specified regular expression. PERL-compatible regular expressions are used, see pcre2pattern(3) for a detailed description of the syntax. The normal grep can work in PCRE mode with -P option. And as described here , I can use -o to only match pattern, and \K in pattern itself to drop the beginning. So this command:
$ journalctl _COMM=kwin_wayland -o cat --since "-10s" | grep -Po "js: \K.*"
hello
gives me pretty much what I want (unfortunately, it also cuts the next line of message). I would like to use a single command, i.e. not piping to normal grep, but use the -g option of journalctl. I can specify such pattern for internal grep:
$ journalctl _COMM=kwin_wayland -o cat --since "-10s" -g "js: \K.*" 
js: hello
goodbue
And it prints my message (fortunately, with next line of message). But it is with "js:" part. I want to drop it. Is it possible to specify journalctl's internal grep option "-o" somehow? Alternatively, I could use grouping in the pattern, but again, how do I specify that I want to output only that group?
Asked by Ashark (1069 rep)
Jul 16, 2023, 11:20 AM