I used to grep log files like an animal. Then I actually read the journalctl man page and felt stupid for years of wasted time. Here are the five tricks I use daily that save me from drowning in logs.

Dark terminal screen with logs
What your screen looks like at 2am when something breaks ( and you forgot journalctl exists )

1. Filter by Unit

This is the one I use most. Nobody scrolls through every log on a server. You filter by service name and suddenly the noise disappears.

journalctl -u nginx.service
journalctl -u docker --since today

The --since flag is your friend. Combine it with unit filtering and you only see what matters.

2. Follow Logs in Real Time

Like tail -f but better. journalctl -f streams logs as they arrive, and you can combine it with any filter.

journalctl -u postgresql -f
journalctl -f -p err

That second one follows only errors. I keep it in a tmux pane when I deploy new stuff. Saves me from switching tabs every five seconds.

Server room with blinking lights
Server rooms look cool ( but the logs inside them are a nightmare to read )

3. Filter by Priority

journalctl uses syslog priority levels 0-7. In practice you only care about 0-3.

journalctl -p err          # errors only ( 3 )
journalctl -p notice        # notice and above ( 5 )
journalctl -p 0..3          # emergency through error

The range syntax with .. is new to a lot of people. It works. Use it.

4. Time Travel with --since and --until

Most people know --since. Fewer people combine it with --until for a precise window. This is how I debug incidents.

journalctl --since "2026-07-01 14:00" --until "2026-07-01 14:30"
journalctl --since "1 hour ago" -u sshd

The relative time strings are underrated. "1 hour ago", "yesterday", "2 days ago" all work. No mental math required.

5. Output Formatting

The default output is fine for terminals. But when you need to grep, parse, or share logs, change the format.

journalctl -u nginx -o json-pretty     # structured JSON
journalctl -u nginx -o cat              # just the message, no metadata
journalctl -u nginx -o short-precise    # timestamps with microsecond precision

-o cat is my go-to for quick scanning. No hostname, no timestamp, just the message. Combine it with -p err and you get a clean list of what broke.

Keyboard and screen with code
The only keyboard shortcut you need: journalctl -f

Bonus: Disk Usage

Logs eat disk space. Check how much with:

journalctl --disk-usage

And vacuum old entries:

journalctl --vacuum-time=7d
journalctl --vacuum-size=500M

I have both in a cron job on every server. Logs fill up faster than you think, especially when something starts error-looping at 2am.

Conclusion

journalctl is one of those tools I ignored for years because the output looked ugly on first glance. Turns out it's incredibly powerful once you learn five flags. Stop grepping text files. Use the tool that's already there.

Thank you.