journalctl looks like a great tool for looking through logs, but I'm stuck on what feels like a simple ask: I want to see all cron messages that contain the phrase
Of course I can do this
journalctl -u cron.service | grep update-ipsets
but then you lose all the other benefits of journalctl's output (colour coding, auto paging, live view etc.)
journalctl -u cron.service MESSAGE=update-ipsets journalctl -u cron.service "MESSAGE=*update-ipsets*" journalctl -u cron.service "MESSAGE=.*update-ipsets.*" journalctl -u cron.service "MESSAGE=/.*update-ipsets.*/"
And you don't want to experiment by hitting tab after
MESSAGE= - hangs the (zsh/Debian Jessie) shell and Ctrl-C didn't help either!
I sort of can't believe that it doesn't have this basic functionality built in, so I'm sure I must have missed something?