HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH. |  |
NAME |SYNOPSIS |DESCRIPTION |RETURN VALUE |NOTES |EXAMPLES |HISTORY |SEE ALSO |COLOPHON | |
SD_JOURNAL_ADD_MATCH(3) sd_journal_add_matchSD_JOURNAL_ADD_MATCH(3)sd_journal_add_match, sd_journal_add_disjunction, sd_journal_add_conjunction, sd_journal_flush_matches - Add or remove entry matches
#include <systemd/sd-journal.h>int sd_journal_add_match(sd_journal *j, const void *data,size_tsize);int sd_journal_add_disjunction(sd_journal *j);int sd_journal_add_conjunction(sd_journal *j);void sd_journal_flush_matches(sd_journal *j);
sd_journal_add_match()adds a match by which to filter the entries of the journal file. Matches applied with this call will filter what can be iterated through and read from the journal file via calls likesd_journal_next(3) andsd_journal_get_data(3). Parameterdata must be of the form "FIELD=value", where theFIELD part is a short uppercase string consisting only of 0–9, A–Z and the underscore; it may not begin with two underscores or be the empty string. Thevalue part may be anything, including binary. Parametersize specifies the number of bytes indata (i.e. the length ofFIELD, plus one, plus the length ofvalue). Parametersize may also be specified as0, in which casedata must be aNUL-terminated string, and the bytes before the terminating zero are used as the match. If a match is applied, only entries with this field set will be iterated. Multiple matches may be active at the same time: If they apply to different fields, only entries with both fields set like this will be iterated. If they apply to the same fields, only entries where the field takes one of the specified values will be iterated. Well known fields are documented insystemd.journal-fields(7). Whenever a new match is added the current entry position is reset, andsd_journal_next(3) (or a similar call) needs to be called before entries can be read again.sd_journal_add_disjunction()may be used to insert a disjunction (i.e. logical OR) in the match list. If this call is invoked, all previously added matches since the last invocation ofsd_journal_add_disjunction()orsd_journal_add_conjunction()are combined in an OR with all matches added afterwards, untilsd_journal_add_disjunction()orsd_journal_add_conjunction()is invoked again to begin the next OR or AND term.sd_journal_add_conjunction()may be used to insert a conjunction (i.e. logical AND) in the match list. If this call is invoked, all previously added matches since the last invocation ofsd_journal_add_conjunction()are combined in an AND with all matches added afterwards, untilsd_journal_add_conjunction()is invoked again to begin the next AND term. The combination ofsd_journal_add_match(),sd_journal_add_disjunction()andsd_journal_add_conjunction()may be used to build complex search terms, even though full logical expressions are not available. Note thatsd_journal_add_conjunction()operates one level 'higher' thansd_journal_add_disjunction(). It is hence possible to build an expression of AND terms, consisting of OR terms, consisting of AND terms, consisting of OR terms of matches (the latter OR expression is implicitly created for matches with the same field name, see above).sd_journal_flush_matches()may be used to flush all matches, disjunction and conjunction terms again. After this call all filtering is removed and all entries in the journal will be iterated again. Note that filtering via matches only applies to the way the journal is read, it has no effect on storage on disk.
sd_journal_add_match(),sd_journal_add_disjunction()andsd_journal_add_conjunction()return 0 on success or a negative errno-style error code.sd_journal_flush_matches()returns nothing.
Functions described here are available as a shared library, which can be compiled against and linked to with thelibsystemd pkg-config(1) file. The code described here usesgetenv(3), which is declared to be not multi-thread-safe. This means that the code calling the functions described here must not callsetenv(3) from a parallel thread. It is recommended to only do calls tosetenv()from an early phase of the program when no other threads have been started.
The following example adds matches to a journal context object to iterate only through messages generated by the Avahi service at the four error log levels, plus all messages of the message ID 03bb1dab98ab4ecfbf6fff2738bdd964 coming from any service (this example lacks the necessary error checking): ... int add_matches(sd_journal *j) { sd_journal_add_match(j, "_SYSTEMD_UNIT=avahi-daemon.service", 0); sd_journal_add_match(j, "PRIORITY=0", 0); sd_journal_add_match(j, "PRIORITY=1", 0); sd_journal_add_match(j, "PRIORITY=2", 0); sd_journal_add_match(j, "PRIORITY=3", 0); sd_journal_add_disjunction(j); sd_journal_add_match(j, "MESSAGE_ID=03bb1dab98ab4ecfbf6fff2738bdd964", 0); }sd_journal_add_match(),sd_journal_add_disjunction(), andsd_journal_flush_matches()were added in version 187.sd_journal_add_conjunction()was added in version 202.
systemd(1),sd-journal(3),sd_journal_open(3),sd_journal_next(3),sd_journal_get_data(3),systemd.journal-fields(7)
This page is part of thesystemd (systemd system and service manager) project. Information about the project can be found at ⟨http://www.freedesktop.org/wiki/Software/systemd⟩. If you have a bug report for this manual page, see ⟨http://www.freedesktop.org/wiki/Software/systemd/#bugreports⟩. This page was obtained from the project's upstream Git repository ⟨https://github.com/systemd/systemd.git⟩ on 2025-08-11. (At that time, the date of the most recent commit that was found in the repository was 2025-08-11.) If you discover any rendering problems in this HTML version of the page, or you believe there is a better or more up-to-date source for the page, or you have corrections or improvements to the information in this COLOPHON (which isnot part of the original manual page), send a mail to man-pages@man7.orgsystemd 258~rc2SD_JOURNAL_ADD_MATCH(3)Pages that refer to this page:sd-journal(3), sd_journal_enumerate_fields(3), sd_journal_query_unique(3), systemd.directives(7), systemd.index(7), systemd.journal-fields(7)
HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH. | |