On Wed, Nov 29, 2017 at 2:18 PM, Thomas GÃŒttler <
is there a spec or docs about the datastructure of a log entry in
The binary on-disk format is documented here:
journalctl can also export to text format:
Which fields does a log record have?
There's no fixed schema, although a base list can be found in `man
, and you can generally expect journald to always add the same
Out of the "application" fields, you can only assume that MESSAGE= will be
present, but everything else is up to the application. IMHO, it is useful
to supply fields which are useful
a) for filtering, e.g. systemd uses MESSAGE_ID, NetworkManager sets
NM_DEVICE, recent GLib sets GLIB_DOMAIN;
or b) for substitution in "catalog" explanations/translations (see e.g.
`journalctl -x -u systemd-journald`).
Take a look at `journalctl --fields | sort` or `journalctl -o verbose`, and
you'll see what is being used on your system.
Mantas MikulÄnas <***@gmail.com>