This Emacs major mode is designed for viewing the output from systemd’s journalctl within Emacs. It provides a convenient way to interact with journalctl logs, including fontification, chunked loading for performance, asynchronous journalctl processes, follow mode, and a transient interface for building queries.

To install, place journalctl-mode.el in your load-path and add the following to your .emacs file:

(require 'journalctl-mode)

The mode requires Emacs 27.1 or newer, the Emacs Lisp libraries transient and array, and a system with journalctl and systemctl available.

Alternatively, if journalctl-mode is available through one of your configured package archives, you can install it using use-package:

(use-package journalctl-mode
  :ensure t)

It might be a good idea to define a global key to journalctl with:

(global-set-key (kbd "C-c t") 'journalctl)

or with use-package:

(use-package journalctl-mode
  :ensure t
  :bind (("C-c t" . journalctl)))

• Fontification: Customize the appearance of errors, warnings, starting and finished processes, timestamps, hosts, and process names with faces.
• Chunked Loading: Load journalctl output in manageable chunks for better performance.
• Asynchronous Processes: journalctl output is collected asynchronously, so Emacs stays responsive while the command is running.
• Keyword Highlighting: Define custom keywords for error, warning, starting, and finished log messages.
• Transient Menu: Build journalctl queries interactively using output, source, constraint, and filter options.
• Follow Mode: Run journalctl with -f and keep up with new log entries asynchronously.
• Completion: Select known system units, user units, boots, output fields, facilities, output formats, and priority ranges from dynamically generated lists.

Once installed, journalctl-mode can be invoked with M-x journalctl.

The command initially loads up to 250 journal entries into the *journalctl* buffer and opens the transient menu. The menu allows journalctl command-line options to be combined dynamically and the query to be rerun without leaving Emacs.

The transient menu contains the following groups:

• Output: --all, --no-full, --merge, --field, --quiet, --utc, and --output.
• Sources: --machine, --directory, --file, --root, --image, and --namespace.
• Constraint: kernel, system or user messages, boot, identifier, unit, user unit, facility, and priority.
• Filters: --since, --until, reverse output, catalog explanations, line limit, and grep pattern.

From the transient menu:

Follow mode starts journalctl -f with the currently selected transient options. The initial number of lines used for follow mode is controlled by journalctl-follow-lines. To keep the buffer from growing without limit, older lines are removed as new output arrives.

Customize the mode to your liking by setting the following variables:

• journalctl-chunk-size: Number of lines per chunk (default 250).
• journalctl-error-keywords: List of keywords to highlight as errors.
• journalctl-warn-keywords: List of keywords to highlight as warnings.
• journalctl-starting-keywords: Keywords for starting processes.
• journalctl-finished-keywords: Keywords for finished processes.
• journalctl-follow-lines: Number of initial lines to show in follow mode (default "240").
• journalctl-default-options: List of default options in the transient menu (default ("--lines=240")).

The faces journalctl-error-face, journalctl-warning-face, journalctl-starting-face, journalctl-finished-face, journalctl-timestamp-face, journalctl-host-face, and journalctl-process-face can also be customized.

There is another package journalctl (rather than journalctl-mode) by James Ferguson that fetches and interleaves JSON data using multiple simultaneous asynchronous journalctl queries, while mine offers a UI for query-building and chunked asynchronous data loading.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.

For support, feedback, or to contribute to the project, please visit the homepage at https://github.com/SebastianMeisel/journalctl-mode.

Thanks to all contributors and users for their support and feedback which continue to improve this mode.