How to use hl with journalctl?

[pamburus]

I'd like to use hl to view and analyze systemd journal logs from journalctl.

What's the recommended way to pipe journalctl output to hl? Are there any specific flags or options I should use for the best experience?

[pamburus]

Using hl with journalctl

hl is designed to work seamlessly with journalctl for viewing and analyzing systemd journal logs in a human-readable format.

Basic Usage

The most straightforward way to use hl with journalctl is to pipe the output:

journalctl -o json -a | hl

Important:

• Use the -o json option with journalctl to output logs in JSON format, which hl can parse and display beautifully.
• Use the -a (or --all) flag to show all fields in full, without truncating long messages or field values.

Common Use Cases

1. View Recent System Logs

journalctl -o json -a -n 100 | hl

Shows the last 100 log entries in a readable format.

2. Follow Live Logs (Streaming)

journalctl -o json -a -f | hl -P

• -f tells journalctl to follow the log (like tail -f)
• -a prevents truncation of long messages
• -P tells hl to disable the pager, allowing continuous streaming

3. Filter by Service

journalctl -o json -a -u nginx.service | hl

View logs for a specific systemd unit (e.g., nginx service).

4. Filter by Priority Level

journalctl -o json -a -p err | hl

Show only error-level messages and above.

5. Combine with hl's Filtering

journalctl -o json -a | hl -l error

You can also use hl's built-in level filtering with -l flag.

6. Filter by Time Range

journalctl -o json -a --since "2026-02-14" --until "2026-02-15" | hl

Or use hl's time filtering:

journalctl -o json -a | hl --since "2026-02-14" --until "2026-02-15"

7. Multiple Services with Chronological Sorting

hl -F <(journalctl -o json -a -u service1.service -f) <(journalctl -o json -a -u service2.service -f)

This follows multiple services simultaneously and sorts their logs chronologically in real-time.

Field-Based Filtering

Since journalctl outputs JSON, you can use hl's powerful filtering capabilities:

# Filter by specific field values
journalctl -o json -a | hl -f _SYSTEMD_UNIT=nginx.service

# Filter by message content
journalctl -o json -a | hl -f MESSAGE~=error

# Complex queries
journalctl -o json -a | hl -q 'PRIORITY <= 3 or MESSAGE contain "failed"'

Hiding/Showing Specific Fields

Journalctl JSON output includes many fields. You can control what's displayed:

# Hide all fields except MESSAGE
journalctl -o json -a | hl --hide '*' --hide '!MESSAGE'

# Hide specific noisy fields
journalctl -o json -a | hl -h _TRANSPORT -h _BOOT_ID -h _MACHINE_ID

Using Different Output Formats

If you prefer logfmt or other formats:

# Explicitly specify JSON format
journalctl -o json -a | hl --input-format json

# Auto-detect format (default)
journalctl -o json -a | hl

Time Zone Configuration

# Use local time zone
journalctl -o json -a | hl -L

# Use specific time zone
journalctl -o json -a | hl -Z America/New_York

# Custom time format
journalctl -o json -a | hl -t "%Y-%m-%d %H:%M:%S"

Performance Tips

For large journal files, you can export to a file and process it:

# Export journal to file
journalctl -o json -a > journal-export.jsonl

# Process with hl
hl journal-export.jsonl

# With sorting
hl -s journal-export.jsonl

Compressed Logs

If you export journal logs and compress them:

journalctl -o json -a | gzip > journal.jsonl.gz
hl journal.jsonl.gz  # hl automatically handles gzip

hl supports bzip2, gzip, xz, and zstd compression automatically.

Kernel Logs

journalctl -o json -a -k | hl

View kernel messages specifically.

Boot Logs

# Current boot
journalctl -o json -a -b | hl

# Previous boot
journalctl -o json -a -b -1 | hl

Recommended Aliases

Add these to your ~/.bashrc or ~/.zshrc:

alias jhl='journalctl -o json -a | hl'
alias jhlf='journalctl -o json -a -f | hl -P'
alias jhle='journalctl -o json -a -p err | hl'

Then simply use:

jhl          # View journal with hl
jhlf         # Follow journal
jhle         # View errors only

Configuration File

For persistent settings, create ~/.config/hl/config.toml:

# Optimize for journalctl
input_format = "json"
time_zone = "local"
time_format = "%Y-%m-%d %H:%M:%S.%3N"

# Hide noisy systemd fields
hide = [
    "_TRANSPORT",
    "_BOOT_ID",
    "_MACHINE_ID",
    "_HOSTNAME",
]

Summary

The key to using hl with journalctl is:

1. Use journalctl -o json -a to output in JSON format with full field values
2. Pipe to hl for beautiful, human-readable display
3. Use -P flag when following logs in real-time
4. Leverage hl's filtering with -f, -q, --since, --until, -l options
5. Customize field visibility with --hide option to reduce noise

This combination provides a powerful, fast, and user-friendly way to work with systemd journals!