3

I have the following journal messages:

$ journalctl _COMM=kwin_wayland -o cat --since "-10s"
...
kwin_screencast: Dropping a screencast frame because the compositor is slow
kwin_screencast: Dropping a screencast frame because the compositor is slow
js: hello
goodbue
kwin_screencast: Dropping a screencast frame because the compositor is slow
kwin_screencast: Dropping a screencast frame because the compositor is slow
...

I want to extract only messages starting with "js: ".

From journalctl manual:

-g, --grep=
Filter output to entries where the MESSAGE= field matches the specified regular expression. PERL-compatible regular expressions are used, see pcre2pattern(3) for a detailed description of the syntax.

The normal grep can work in PCRE mode with -P option. And as described here, I can use -o to only match pattern, and \K in pattern itself to drop the beginning. So this command:

$ journalctl _COMM=kwin_wayland -o cat --since "-10s" | grep -Po "js: \K.*"
hello

gives me pretty much what I want (unfortunately, it also cuts the next line of message).

I would like to use a single command, i.e. not piping to normal grep, but use the -g option of journalctl.

I can specify such pattern for internal grep:

$ journalctl _COMM=kwin_wayland -o cat --since "-10s" -g "js: \K.*" 
js: hello
goodbue

And it prints my message (fortunately, with next line of message). But it is with "js:" part. I want to drop it.

Is it possible to specify journalctl's internal grep option "-o" somehow?
Alternatively, I could use grouping in the pattern, but again, how do I specify that I want to output only that group?

Ashark
  • 767
  • 7
  • 24
  • Pipe into less and use & to search for lines that start with js (excludes lines without js). – elmo Jul 16 '23 at 15:45
  • Still require piping. I actually want to make a single command. Can you write how exactly "use & to search"? – Ashark Jul 16 '23 at 19:51

0 Answers0