systemd Developer Lennart Poettering lennart@poettering.net sd_journal_add_match 3 sd_journal_add_match sd_journal_add_disjunction sd_journal_flush_matches Add or remove entry matches #include <systemd/sd-journal.h> int sd_journal_add_match sd_journal* j const void* data size_t size int sd_journal_add_disjunction sd_journal* j int sd_journal_flush_matches sd_journal* j sd_journal_add_match() adds a match by which to filter the entries of the journal file. Matches applied with this call will filter what can be iterated through and read from the journal file via calls like sd_journal_next3 and sd_journal_get_data3. Matches are of the form FIELD=value, where the field part is a short uppercase string consisting only of 0-9, A-Z and the underscore. It may not begin with two underscores or be the empty string. The value part may be any value, including binary. If a match is applied only entries with this field set will be iterated. Multiple matches may be active at the same time: if they apply to different fields only entries with both fields set like this will be iterated, if they apply to the same fields only entries where the field takes one of the specified values will be iterated. Well known fields are documented in systemd.journal-fields7. Whenever a new match is added the current entry position is reset, and sd_journal_next3 (or a similar call) needs to be called before entries can be read again. sd_journal_add_disjunction() may be used to insert a disjunction (i.e. logical OR) in the match list. If this call is invoked all previously added matches are combined in an OR with all matches added afterwards, until sd_journal_add_disjunction() is invoked again to begin the next OR term. The combination of sd_journal_add_match() and sd_journal_add_disjunction() may be used to build complex search terms, even though full logical expressions are not available. sd_journal_flush_matches() may be used to flush all matches and disjunction terms again. After this call all filtering is removed and all entries in the journal will be iterated again. Note that filtering via matches only applies to way the journal is read, it has no effect on storage on disk. sd_journal_add_match() and sd_journal_add_disjunction() return 0 on success or a negative errno-style error code. sd_journal_flush_matches() returns nothing. The sd_journal_add_match(), sd_journal_add_disjunction() and sd_journal_flush_matches() interfaces are available as shared library, which can be compiled and linked to with the libsystemd-journal pkg-config1 file. The following example adds matches to a journal context object to iterate only through messages generated by the Avahi service at the four error log levels, plus all messages of the message ID 03bb1dab98ab4ecfbf6fff2738bdd964 coming from any service (this example lacks the necessary error checking): ... int add_matches(sd_journal *j) { sd_journal_add_match(j, "_SYSTEMD_UNIT=avahi-daemon.service"); sd_journal_add_match(j, "PRIORITY=0"); sd_journal_add_match(j, "PRIORITY=1"); sd_journal_add_match(j, "PRIORITY=2"); sd_journal_add_match(j, "PRIORITY=3"); sd_journal_add_disjunction(j); sd_journal_add_match(j, "MESSAGE_ID=03bb1dab98ab4ecfbf6fff2738bdd964"); } systemd1, sd-journal3, sd_journal_open3, sd_journal_next3, sd_journal_get_data3, systemd.journal-fields7