1SD_JOURNAL_ADD_MATCH(3) sd_journal_add_match SD_JOURNAL_ADD_MATCH(3)
2
6 sd_journal_add_match, sd_journal_add_disjunction,
7 sd_journal_add_conjunction, sd_journal_flush_matches - Add or remove
8 entry matches
9
11 #include <systemd/sd-journal.h>
12 int sd_journal_add_match(sd_journal *j, const void *data, size_t size);
14 int sd_journal_add_disjunction(sd_journal *j);
16 int sd_journal_add_conjunction(sd_journal *j);
18 void sd_journal_flush_matches(sd_journal *j);
20
22 sd_journal_add_match() adds a match by which to filter the entries of
23 the journal file. Matches applied with this call will filter what can
24 be iterated through and read from the journal file via calls like
25 sd_journal_next(3) and sd_journal_get_data(3). Matches are of the form
26 "FIELD=value", where the field part is a short uppercase string
27 consisting only of 0-9, A-Z and the underscore. It may not begin with
28 two underscores or be the empty string. The value part may be any
29 value, including binary. If a match is applied, only entries with this
30 field set will be iterated. Multiple matches may be active at the same
31 time: If they apply to different fields, only entries with both fields
32 set like this will be iterated. If they apply to the same fields, only
33 entries where the field takes one of the specified values will be
34 iterated. Well known fields are documented in systemd.journal-
35 fields(7). Whenever a new match is added the current entry position is
36 reset, and sd_journal_next(3) (or a similar call) needs to be called
37 before entries can be read again.
38 sd_journal_add_disjunction() may be used to insert a disjunction (i.e.
40 logical OR) in the match list. If this call is invoked, all previously
41 added matches since the last invocation of sd_journal_add_disjunction()
42 or sd_journal_add_conjunction() are combined in an OR with all matches
43 added afterwards, until sd_journal_add_disjunction() or
44 sd_journal_add_conjunction() is invoked again to begin the next OR or
45 AND term.
46 sd_journal_add_conjunction() may be used to insert a conjunction (i.e.
48 logical AND) in the match list. If this call is invoked, all previously
49 added matches since the last invocation of sd_journal_add_conjunction()
50 are combined in an AND with all matches added afterwards, until
51 sd_journal_add_conjunction() is invoked again to begin the next AND
52 term. The combination of sd_journal_add_match(),
53 sd_journal_add_disjunction() and sd_journal_add_conjunction() may be
54 used to build complex search terms, even though full logical
55 expressions are not available. Note that sd_journal_add_conjunction()
56 operates one level 'higher' than sd_journal_add_disjunction(). It is
57 hence possible to build an expression of AND terms, consisting of OR
58 terms, consisting of AND terms, consisting of OR terms of matches (the
59 latter OR expression is implicitly created for matches with the same
60 field name, see above).
61 sd_journal_flush_matches() may be used to flush all matches,
63 disjunction and conjunction terms again. After this call all filtering
64 is removed and all entries in the journal will be iterated again.
65 Note that filtering via matches only applies to the way the journal is
67 read, it has no effect on storage on disk.
68
70 sd_journal_add_match(), sd_journal_add_disjunction() and
71 sd_journal_add_conjunction() return 0 on success or a negative
72 errno-style error code. sd_journal_flush_matches() returns nothing.
73
75 The sd_journal_add_match(), sd_journal_add_disjunction(),
76 sd_journal_add_conjunction() and sd_journal_flush_matches() interfaces
77 are available as a shared library, which can be compiled and linked to
78 with the libsystemd pkg-config(1) file.
79
81 The following example adds matches to a journal context object to
82 iterate only through messages generated by the Avahi service at the
83 four error log levels, plus all messages of the message ID
84 03bb1dab98ab4ecfbf6fff2738bdd964 coming from any service (this example
85 lacks the necessary error checking):
86 ...
88 int add_matches(sd_journal *j) {
89 sd_journal_add_match(j, "_SYSTEMD_UNIT=avahi-daemon.service", 0);
90 sd_journal_add_match(j, "PRIORITY=0", 0);
91 sd_journal_add_match(j, "PRIORITY=1", 0);
92 sd_journal_add_match(j, "PRIORITY=2", 0);
93 sd_journal_add_match(j, "PRIORITY=3", 0);
94 sd_journal_add_disjunction(j);
95 sd_journal_add_match(j, "MESSAGE_ID=03bb1dab98ab4ecfbf6fff2738bdd964", 0);
96 }
97
99 systemd(1), sd-journal(3), sd_journal_open(3), sd_journal_next(3),
100 sd_journal_get_data(3), systemd.journal-fields(7)
101systemd 219 SD_JOURNAL_ADD_MATCH(3)