Sample Header Ad - 728x90

How can I exclude specific SYSLOG_IDENTIFIER with Journalctl filtering?

0 votes
1 answer
31 views
I'm encountering an issue with journalctl filtering on systemd version 256 (256.10). I'm trying to view logs from the last 48 hours while excluding entries related to Syncthing, but I'm unable to achieve this using SYSLOG_IDENTIFIER filtering. I've tried the following approaches, all of which have failed to produce the expected results: 1.
journalctl --since "48 hours ago" SYSLOG_IDENTIFIER!=syncthing
   Error: Failed to add match 'SYSLOG_IDENTIFIER!=syncthing': Invalid argument
2.
journalctl --since "48 hours ago" SYSLOG_IDENTIFIER!="syncthing" SYSLOG_IDENTIFIER!="1i50cgkm5ycymi8kkk064w8x6xp6iywg-merge-syncthing-config"
   Result: -- No entries --
3.
journalctl --since "48 hours ago" SYSLOG_IDENTIFIER!~"syncthing"
   Result: -- No entries --
4. Listing all SYSLOG_IDENTIFIERs except Syncthing also resulted in no entries. The grep approach (journalctl --since "48 hours ago" | grep -v syncthing) works, but I'm specifically interested in using journalctl's native filtering capabilities. Could you please advise on the correct syntax for excluding specific SYSLOG_IDENTIFIERs in journalctl queries? Is this a known issue or limitation in the current version?
Asked by Jason Hunter (227 rep)
Jul 12, 2025, 01:06 PM
Last activity: Jul 12, 2025, 03:04 PM