In journalctl internal grep, is it possible to specify option to only output matched pattern?
4
votes
0
answers
5327
views
I have the following journal messages:
>Filter output to entries where the MESSAGE= field matches the specified regular expression. PERL-compatible regular expressions are used, see pcre2pattern(3) for a detailed description of the syntax. The normal grep can work in PCRE mode with -P option. And as described here , I can use
$ journalctl _COMM=kwin_wayland -o cat --since "-10s"
...
kwin_screencast: Dropping a screencast frame because the compositor is slow
kwin_screencast: Dropping a screencast frame because the compositor is slow
js: hello
goodbue
kwin_screencast: Dropping a screencast frame because the compositor is slow
kwin_screencast: Dropping a screencast frame because the compositor is slow
...
I want to extract only messages starting with "js: ".
From journalctl manual:
> -g, --grep=>Filter output to entries where the MESSAGE= field matches the specified regular expression. PERL-compatible regular expressions are used, see pcre2pattern(3) for a detailed description of the syntax. The normal grep can work in PCRE mode with -P option. And as described here , I can use
-o
to only match pattern, and \K
in pattern itself to drop the beginning. So this command:
$ journalctl _COMM=kwin_wayland -o cat --since "-10s" | grep -Po "js: \K.*"
hello
gives me pretty much what I want (unfortunately, it also cuts the next line of message).
I would like to use a single command, i.e. not piping to normal grep, but use the -g
option of journalctl.
I can specify such pattern for internal grep:
$ journalctl _COMM=kwin_wayland -o cat --since "-10s" -g "js: \K.*"
js: hello
goodbue
And it prints my message (fortunately, with next line of message). But it is with "js:" part. I want to drop it.
Is it possible to specify journalctl's internal grep option "-o" somehow?
Alternatively, I could use grouping in the pattern, but again, how do I specify that I want to output only that group?
Asked by Ashark
(1069 rep)
Jul 16, 2023, 11:20 AM