# systemd v262.1 journalctl -o json (docs/JOURNAL_EXPORT_FORMATS.md, docs/JOURNAL_FILE_FORMAT.md):
# the entry carries the line a program printed in MESSAGE, which is read again and whose own level
# wins over PRIORITY, a syslog severity as a string. The program is SYSLOG_IDENTIFIER, else _COMM,
# else the unit; the time is __REALTIME_TIMESTAMP and the uptime __MONOTONIC_TIMESTAMP, both in
# microseconds. A field that holds bytes which are not printable UTF-8 prints as an array of
# numbers, a field set more than once as an array of values, and one over 4,096 bytes as null.
{"__CURSOR":"s=7c1;i=1","__REALTIME_TIMESTAMP":"1792606440250581","__MONOTONIC_TIMESTAMP":"12345678","_BOOT_ID":"9f1","PRIORITY":"6","SYSLOG_IDENTIFIER":"pumpd","_COMM":"pumpd","MESSAGE":"started","_SYSTEMD_UNIT":"pumpd.service"} ⇒ {"rule": "journal", "level": "info", "leveled": true, "name": "pumpd", "message": "started", "stamp": "1792606440250581", "device_ns": 12345678000, "prefixed": true}
{"__CURSOR":"s=7c1;i=2","__REALTIME_TIMESTAMP":"1792606440250600","__MONOTONIC_TIMESTAMP":"12345697","PRIORITY":"6","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":"ERROR: disk full"} ⇒ {"rule": "journal", "level": "error", "name": "pumpd", "message": "disk full"}
{"__CURSOR":"s=7c1;i=3","PRIORITY":"6","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":[112,114,101,115,115,117,114,101,32,108,111,119]} ⇒ {"rule": "journal", "level": "info", "name": "pumpd", "message": "pressure low"}
{"__CURSOR":"s=7c1;i=4","PRIORITY":"6","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":[27,91,51,49,109,69,82,82,79,82,58,32,112,117,109,112,32,115,116,97,108,108,101,100,27,91,48,109]} ⇒ {"rule": "journal", "level": "error", "name": "pumpd", "message": "pump stalled"}
{"__CURSOR":"s=7c1;i=5","PRIORITY":"4","MESSAGE":"pressure low","_SYSTEMD_UNIT":"pump.service","CODE_FILE":"pump.c","CODE_LINE":"12"} ⇒ {"rule": "journal", "level": "warn", "name": "pump", "message": "pressure low", "file": "pump.c", "line": 12}
{"__CURSOR":"s=7c1;i=6","PRIORITY":"6","_COMM":"pumpd","MESSAGE":"comm names it","_SYSTEMD_UNIT":"pump.service"} ⇒ {"rule": "journal", "level": "info", "name": "pumpd", "message": "comm names it"}
{"__CURSOR":"s=7c1;i=7","PRIORITY":"3","MESSAGE":["first","second"]} ⇒ {"rule": "journal", "level": "error", "name": "", "message": "first"}
{"__CURSOR":"s=7c1;i=8","PRIORITY":"5","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":null} ⇒ {"rule": "journal", "level": "info", "name": "pumpd", "message": ""}
{"__CURSOR":"s=7c1;i=9","PRIORITY":"6","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":"2026-10-21 10:00:00 WARN app.db: slow query"} ⇒ {"rule": "journal", "level": "warn", "name": "pumpd", "message": "slow query", "stamp": "2026-10-21 10:00:00"}
{"__CURSOR":"s=7c1;i=10","__REALTIME_TIMESTAMP":"1792606440250700","PRIORITY":"6","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":"2026-10-21 10:00:00 WARN app.db: slow query"} ⇒ {"rule": "journal", "level": "warn", "name": "pumpd", "stamp": "1792606440250700", "message": "slow query"}
{"__CURSOR":"s=7c1;i=11","PRIORITY":"6","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":"{\"level\":\"warn\",\"msg\":\"json inside\"}"} ⇒ {"rule": "journal", "level": "warn", "name": "pumpd", "message": "json inside"}
{"__CURSOR":"s=7c1;i=12","PRIORITY":"6","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":"rail=13.65V"} ⇒ {"rule": "journal+kv", "level": "info", "name": "pumpd", "message": "rail=13.65V", "values": [["rail", 13.65, "V"]]}
{"__CURSOR":"s=7c1;i=13","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":"no priority"} ⇒ {"rule": "journal", "level": "info", "leveled": false, "name": "pumpd", "message": "no priority"}
{"__CURSOR":"s=7c1;i=14","PRIORITY":"6","SYSLOG_IDENTIFIER":"pumpd","MESSAGE":"Traceback (most recent call last):"} ⇒ {"rule": "journal", "level": "info", "name": "pumpd", "message": "Traceback (most recent call last):"}
{"__CURSOR":"s=7c1;i=15","PRIORITY":"2","SYSLOG_IDENTIFIER":"pumpd","_COMM":"pumpd-worker","MESSAGE":"giving up"} ⇒ {"rule": "journal", "level": "critical", "name": "pumpd", "message": "giving up"}
{"__CURSOR":"s=7c1;i=19","PRIORITY":"6","SYSLOG_IDENTIFIER":"","_COMM":"pumpd","MESSAGE":"an empty identifier"} ⇒ {"rule": "journal", "level": "info", "name": "pumpd", "message": "an empty identifier"}
{"__CURSOR":"s=7c1;i=20","PRIORITY":"6","MESSAGE":"socket activated","_SYSTEMD_UNIT":"pump.socket"} ⇒ {"rule": "journal", "level": "info", "name": "pump.socket", "message": "socket activated"}
{"__CURSOR":"s=7c1;i=21","PRIORITY":"6","MESSAGE":"x","CODE_FILE":["a.c","b.c"],"CODE_LINE":"abc"} ⇒ {"rule": "journal", "level": "info", "name": "", "message": "x", "file": "a.c", "line": 0}
# constructed {"_TRANSPORT":"stdout","PRIORITY":"6","SYSLOG_IDENTIFIER":"myapp","MESSAGE":"started","_SYSTEMD_UNIT":"myapp.service"} ⇒ {"rule": "journal", "level": "info", "name": "myapp", "message": "started", "values": [], "prefixed": true, "device_ns": null}
# constructed {"_TRANSPORT":"kernel","PRIORITY":"3","SYSLOG_IDENTIFIER":"kernel","MESSAGE":"usb 1-1: error -71"} ⇒ {"rule": "journal", "level": "error", "name": "kernel", "message": "usb 1-1: error -71", "values": [], "prefixed": true, "device_ns": null}
# constructed {"PRIORITY":"4","_COMM":"pumpd","MESSAGE":"pressure high","CODE_FILE":"src/pump.c","CODE_LINE":"42","CODE_FUNC":"check"} ⇒ {"rule": "journal", "level": "warn", "name": "pumpd", "message": "pressure high", "values": [], "prefixed": true, "file": "src/pump.c", "line": 42, "device_ns": null}
# constructed {"PRIORITY":"7","MESSAGE":"no identifier"} ⇒ {"rule": "journal", "level": "debug", "name": "", "message": "no identifier", "values": [], "prefixed": true, "device_ns": null}
# constructed {"PRIORITY":6,"MESSAGE":"a number where journald writes a string"} ⇒ {"rule": "journal", "level": "info", "leveled": true, "name": "", "message": "a number where journald writes a string"}
# constructed {"PRIORITY":"8","MESSAGE":"not a severity"} ⇒ {"rule": "plain", "level": "info", "message": "{\"PRIORITY\":\"8\",\"MESSAGE\":\"not a severity\"}"}
# constructed {"PRIORITY":"16","MESSAGE":"two digits"} ⇒ {"rule": "plain", "level": "info", "message": "{\"PRIORITY\":\"16\",\"MESSAGE\":\"two digits\"}"}
# constructed {"PRIORITY":"-1","MESSAGE":"negative"} ⇒ {"rule": "plain", "level": "info", "message": "{\"PRIORITY\":\"-1\",\"MESSAGE\":\"negative\"}"}
# constructed {"MESSAGE":"neither a cursor nor a priority"} ⇒ {"rule": "plain", "level": "info", "message": "{\"MESSAGE\":\"neither a cursor nor a priority\"}"}
# constructed {"__CURSOR":"s=7c1;i=16","PRIORITY":"6"} ⇒ {"rule": "plain", "level": "info", "message": "{\"__CURSOR\":\"s=7c1;i=16\",\"PRIORITY\":\"6\"}"}
# constructed {"priority":"6","message":"lower-case keys"} ⇒ {"rule": "plain", "level": "info", "message": "{\"priority\":\"6\",\"message\":\"lower-case keys\"}"}
# constructed {"__CURSOR":"s=7c1;i=17","PRIORITY":"6","MESSAGE":"x"} tail ⇒ {"rule": "plain", "level": "info", "message": "{\"__CURSOR\":\"s=7c1;i=17\",\"PRIORITY\":\"6\",\"MESSAGE\":\"x\"} tail"}
# constructed [{"__CURSOR":"s=7c1;i=18","PRIORITY":"6","MESSAGE":"x"}] ⇒ {"rule": "plain", "level": "info", "message": "[{\"__CURSOR\":\"s=7c1;i=18\",\"PRIORITY\":\"6\",\"MESSAGE\":\"x\"}]"}
# constructed {"level":"warn","msg":"MESSAGE in a value"} ⇒ {"rule": "json", "level": "warn", "message": "MESSAGE in a value"}
# constructed {"field":"MESSAGE"} ⇒ {"rule": "plain", "level": "info", "message": "{\"field\":\"MESSAGE\"}"}
# constructed {"log":"ERROR docker wraps the line\n","stream":"stderr","time":"2026-10-21T18:00:00Z"} ⇒ {"rule": "container", "level": "error", "message": "docker wraps the line"}
# constructed Oct 21 14:03:01 bench-1 pumpd[42]: started ⇒ {"rule": "syslog", "level": "info", "name": "pumpd", "message": "started"}
