I have the following journal messages:
$ journalctl _COMM=kwin_wayland -o cat --since "-10s"
...
kwin_screencast: Dropping a screencast frame because the compositor is slow
kwin_screencast: Dropping a screencast frame because the compositor is slow
js: hello
goodbue
kwin_screencast: Dropping a screencast frame because the compositor is slow
kwin_screencast: Dropping a screencast frame because the compositor is slow
...
I want to extract only messages starting with "js: ".
From journalctl manual:
-g, --grep=
Filter output to entries where the MESSAGE= field matches the specified regular expression. PERL-compatible regular expressions are used, see pcre2pattern(3) for a detailed description of the syntax.
The normal grep can work in PCRE mode with -P option. And as described here, I can use -o to only match pattern, and \K in pattern itself to drop the beginning. So this command:
$ journalctl _COMM=kwin_wayland -o cat --since "-10s" | grep -Po "js: \K.*"
hello
gives me pretty much what I want (unfortunately, it also cuts the next line of message).
I would like to use a single command, i.e. not piping to normal grep, but use the -g option of journalctl.
I can specify such pattern for internal grep:
$ journalctl _COMM=kwin_wayland -o cat --since "-10s" -g "js: \K.*"
js: hello
goodbue
And it prints my message (fortunately, with next line of message). But it is with "js:" part. I want to drop it.
Is it possible to specify journalctl's internal grep option "-o" somehow?
Alternatively, I could use grouping in the pattern, but again, how do I specify that I want to output only that group?