sd_journal_flush_matches(3)

1SD_JOURNAL_ADD_MATCH(3)      sd_journal_add_match      SD_JOURNAL_ADD_MATCH(3)
2
3
4

NAME

6       sd_journal_add_match, sd_journal_add_disjunction,
7       sd_journal_add_conjunction, sd_journal_flush_matches - Add or remove
8       entry matches
9

SYNOPSIS

11       #include <systemd/sd-journal.h>
12
13       int sd_journal_add_match(sd_journal *j, const void *data, size_t size);
14
15       int sd_journal_add_disjunction(sd_journal *j);
16
17       int sd_journal_add_conjunction(sd_journal *j);
18
19       void sd_journal_flush_matches(sd_journal *j);
20

DESCRIPTION

22       sd_journal_add_match() adds a match by which to filter the entries of
23       the journal file. Matches applied with this call will filter what can
24       be iterated through and read from the journal file via calls like
25       sd_journal_next(3) and sd_journal_get_data(3). Parameter data must be
26       of the form "FIELD=value", where the FIELD part is a short uppercase
27       string consisting only of 0–9, A–Z and the underscore; it may not begin
28       with two underscores or be the empty string. The value part may be
29       anything, including binary. Parameter size specifies the number of
30       bytes in data (i.e. the length of FIELD, plus one, plus the length of
31       value). Parameter size may also be specified as 0, in which case data
32       must be a NUL-terminated string, and the bytes before the terminating
33       zero are used as the match.
34
35       If a match is applied, only entries with this field set will be
36       iterated. Multiple matches may be active at the same time: If they
37       apply to different fields, only entries with both fields set like this
38       will be iterated. If they apply to the same fields, only entries where
39       the field takes one of the specified values will be iterated. Well
40       known fields are documented in systemd.journal-fields(7). Whenever a
41       new match is added the current entry position is reset, and
42       sd_journal_next(3) (or a similar call) needs to be called before
43       entries can be read again.
44
45       sd_journal_add_disjunction() may be used to insert a disjunction (i.e.
46       logical OR) in the match list. If this call is invoked, all previously
47       added matches since the last invocation of sd_journal_add_disjunction()
48       or sd_journal_add_conjunction() are combined in an OR with all matches
49       added afterwards, until sd_journal_add_disjunction() or
50       sd_journal_add_conjunction() is invoked again to begin the next OR or
51       AND term.
52
53       sd_journal_add_conjunction() may be used to insert a conjunction (i.e.
54       logical AND) in the match list. If this call is invoked, all previously
55       added matches since the last invocation of sd_journal_add_conjunction()
56       are combined in an AND with all matches added afterwards, until
57       sd_journal_add_conjunction() is invoked again to begin the next AND
58       term. The combination of sd_journal_add_match(),
59       sd_journal_add_disjunction() and sd_journal_add_conjunction() may be
60       used to build complex search terms, even though full logical
61       expressions are not available. Note that sd_journal_add_conjunction()
62       operates one level 'higher' than sd_journal_add_disjunction(). It is
63       hence possible to build an expression of AND terms, consisting of OR
64       terms, consisting of AND terms, consisting of OR terms of matches (the
65       latter OR expression is implicitly created for matches with the same
66       field name, see above).
67
68       sd_journal_flush_matches() may be used to flush all matches,
69       disjunction and conjunction terms again. After this call all filtering
70       is removed and all entries in the journal will be iterated again.
71
72       Note that filtering via matches only applies to the way the journal is
73       read, it has no effect on storage on disk.
74

RETURN VALUE

76       sd_journal_add_match(), sd_journal_add_disjunction() and
77       sd_journal_add_conjunction() return 0 on success or a negative
78       errno-style error code.  sd_journal_flush_matches() returns nothing.
79

NOTES

81       These APIs are implemented as a shared library, which can be compiled
82       and linked to with the libsystemd pkg-config(1) file.
83

EXAMPLES

85       The following example adds matches to a journal context object to
86       iterate only through messages generated by the Avahi service at the
87       four error log levels, plus all messages of the message ID
88       03bb1dab98ab4ecfbf6fff2738bdd964 coming from any service (this example
89       lacks the necessary error checking):
90
91           ...
92           int add_matches(sd_journal *j) {
93             sd_journal_add_match(j, "_SYSTEMD_UNIT=avahi-daemon.service", 0);
94             sd_journal_add_match(j, "PRIORITY=0", 0);
95             sd_journal_add_match(j, "PRIORITY=1", 0);
96             sd_journal_add_match(j, "PRIORITY=2", 0);
97             sd_journal_add_match(j, "PRIORITY=3", 0);
98             sd_journal_add_disjunction(j);
99             sd_journal_add_match(j, "MESSAGE_ID=03bb1dab98ab4ecfbf6fff2738bdd964", 0);
100           }
101

NAME

SYNOPSIS

DESCRIPTION

RETURN VALUE

NOTES

EXAMPLES

SEE ALSO