Protocol field name: systemd_journal
Versions: 3.0.0 to 4.6.0
Back to Display Filter Reference
| Field name | Description | Type | Versions |
|---|---|---|---|
| systemd | Audit field AppArmor | Character string | 3.0.0 to 4.6.0 |
| systemd | Audit field name | Character string | 3.0.0 to 4.6.0 |
| systemd | Audit field operation | Character string | 3.0.0 to 4.6.0 |
| systemd | Audit field profile | Character string | 3.0.0 to 4.6.0 |
| systemd | Audit ID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Audit login UID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Audit session | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Audit type | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Available | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Human readable available | Character string | 3.0.0 to 4.6.0 |
| systemd | Binary data length | Unsigned integer (64 bits) | 3.0.0 to 4.6.0 |
| systemd | Boot ID | Character string | 3.0.0 to 4.6.0 |
| systemd | Effective capability | Character string | 3.0.0 to 4.6.0 |
| systemd | Command line | Character string | 3.0.0 to 4.6.0 |
| systemd | Code file | Character string | 3.0.0 to 4.6.0 |
| systemd | Code func | Character string | 3.0.0 to 4.6.0 |
| systemd | Code line | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Command name | Character string | 3.0.0 to 4.6.0 |
| systemd | Coredump unit | Character string | 3.0.0 to 4.6.0 |
| systemd | Coredump user unit | Character string | 3.0.0 to 4.6.0 |
| systemd | Current use | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Human readable current use | Character string | 3.0.0 to 4.6.0 |
| systemd | Cursor | Character string | 3.0.0 to 4.6.0 |
| systemd | Disk available | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Human readable disk available | Character string | 3.0.0 to 4.6.0 |
| systemd | Disk keep free | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Human readable disk keep free | Character string | 3.0.0 to 4.6.0 |
| systemd | Errno | Signed integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Executable path | Character string | 3.0.0 to 4.6.0 |
| systemd | Unknown field | Label | 3.0.0 to 4.6.0 |
| systemd | Field data | Character string | 3.0.0 to 4.6.0 |
| systemd | Field name | Character string | 3.0.0 to 4.6.0 |
| systemd | Field value | Character string | 3.0.0 to 4.6.0 |
| systemd | GID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Hostname | Character string | 3.0.0 to 4.6.0 |
| systemd | Job result | Character string | 3.0.0 to 4.6.0 |
| systemd | Job type | Character string | 3.0.0 to 4.6.0 |
| systemd | Journal name | Character string | 3.0.0 to 4.6.0 |
| systemd | Journal path | Character string | 3.0.0 to 4.6.0 |
| systemd | Kernel device | Character string | 3.0.0 to 4.6.0 |
| systemd | Kernel subsystem | Character string | 3.0.0 to 4.6.0 |
| systemd | Kernel microseconds | Time offset | 3.0.0 to 4.6.0 |
| systemd | Leader | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Limit | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Human readable limit | Character string | 3.0.0 to 4.6.0 |
| systemd | Line break | Character string | 3.0.0 to 4.6.0 |
| systemd | Machine ID | Character string | 3.0.0 to 4.6.0 |
| systemd | Max use | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Human readable max use | Character string | 3.0.0 to 4.6.0 |
| systemd | Message | Character string | 3.0.0 to 4.6.0 |
| systemd | Message ID | Character string | 3.0.0 to 4.6.0 |
| systemd | Monotonic Timestamp | Time offset | 3.0.0 to 4.6.0 |
| systemd | Field shouldn't be binary | Label | 3.0.0 to 4.6.0 |
| systemd | Object audit login UID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Object audit session | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Object effective capability | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Object command line | Character string | 3.0.0 to 4.6.0 |
| systemd | Object command name | Character string | 3.0.0 to 4.6.0 |
| systemd | Object executable path | Character string | 3.0.0 to 4.6.0 |
| systemd | Object GID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Object PID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Object SELinux context | Character string | 3.0.0 to 4.6.0 |
| systemd | Object systemd cgroup | Character string | 3.0.0 to 4.6.0 |
| systemd | Object systemd invocation ID | Character string | 3.0.0 to 4.6.0 |
| systemd | Object systemd owner UID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Object systemd session | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Object systemd slice | Character string | 3.0.0 to 4.6.0 |
| systemd | Object systemd unit | Character string | 3.0.0 to 4.6.0 |
| systemd | Object systemd user slice | Character string | 3.0.0 to 4.6.0 |
| systemd | Object systemd user unit | Character string | 3.0.0 to 4.6.0 |
| systemd | Object UID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | PID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Priority | Unsigned integer (8 bits) | 3.0.0 to 4.6.0 |
| systemd | Realtime Timestamp | Date and time | 3.0.0 to 4.6.0 |
| systemd | Result | Character string | 3.0.0 to 4.6.0 |
| systemd | Seat ID | Character string | 3.0.0 to 4.6.0 |
| systemd | SELinux context | Character string | 3.0.0 to 4.6.0 |
| systemd | Session ID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Source monotonic timestamp | Time offset | 3.0.0 to 4.6.0 |
| systemd | Source realtime timestamp | Date and time | 3.0.0 to 4.6.0 |
| systemd | Stream ID | Character string | 3.0.0 to 4.6.0 |
| systemd | Syslog facility | Unsigned integer (8 bits) | 3.0.0 to 4.6.0 |
| systemd | Syslog identifier | Character string | 3.0.0 to 4.6.0 |
| systemd | Syslog PID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Systemd cgroup | Character string | 3.0.0 to 4.6.0 |
| systemd | Systemd invocation ID | Character string | 3.0.0 to 4.6.0 |
| systemd | Systemd owner UID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Systemd session | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Systemd slice | Character string | 3.0.0 to 4.6.0 |
| systemd | Systemd unit | Character string | 3.0.0 to 4.6.0 |
| systemd | Systemd user slice | Character string | 3.0.0 to 4.6.0 |
| systemd | Systemd user unit | Character string | 3.0.0 to 4.6.0 |
| systemd | Transport | Character string | 3.0.0 to 4.6.0 |
| systemd | Device tree symlink | Character string | 3.0.0 to 4.6.0 |
| systemd | Device tree node | Character string | 3.0.0 to 4.6.0 |
| systemd | Device tree name | Character string | 3.0.0 to 4.6.0 |
| systemd | UID | Unsigned integer (32 bits) | 3.0.0 to 4.6.0 |
| systemd | Unable to decode field | Label | 3.0.13 to 3.0.14, 3.2.6 to 4.6.0 |
| systemd | Field data | Character string | 3.0.0 to 4.6.0 |
| systemd | Unhandled field type | Label | 3.6.0 to 4.6.0 |
| systemd | User ID | Character string | 3.0.0 to 4.6.0 |
| systemd | User invocation ID | Character string | 3.0.0 to 4.6.0 |
| systemd | Userspace microseconds | Time offset | 3.0.0 to 4.6.0 |
