im_systemd raw_event string FALSE A list of event fields in key-value pairs. Message string FALSE A human-readable message string for the current entry. This is supposed to be the primary text shown to the user. This is usually not translated (but might be in some cases), and not supposed to be parsed for metadata. MessageID string FALSE A 128-bit message identifier for recognizing certain message types, if this is desirable. This should contain a 128-bit identifier formatted as a lower-case hexadecimal string, without any separating dashes or suchlike. This is recommended to be a UUID-compatible ID, but this is not enforced, and formatted differently. Severity string FALSE A priority value between 0 ("emerg") and 7 ("debug") formatted as a string. This field is compatible with syslog's priority concept. SeverityValue integer FALSE A priority value between 0 ("emerg") and 7 ("debug") formatted as a decimal string. This field is compatible with syslog's priority concept. CodeFile string FALSE Code location to generate this message, if known. Contains the source filename. CodeLine integer FALSE Code location to generate this message, if known. Contains the line number. CodeFunc string FALSE Code location to generate this message, if known. Contains the function name. Errno integer FALSE Low-level Unix error number which caused the entry, if any. Contains the numeric value of 'errno' formatted as a decimal string. Facility string FALSE Syslog compatibility fields containing the facility. SourceName string FALSE Syslog compatibility field containing the identifier string (i.e. "tag"). ProcessID string FALSE Syslog compatibility field containing the client PID. User string FALSE User ID of the process the journal entry originates from. Group string FALSE Group ID of the process the journal entry originates from. ProcessName string FALSE Name of the process the journal entry originates from. ProcessExecutable string FALSE Executable path of the process the journal entry originates from. ProcessCmdLine string FALSE Command line of the process the journal entry originates from. Capabilities string FALSE Effective capabilities of the process the journal entry originates from. AuditSession string FALSE Session of the process the journal entry originates from, as maintained by the kernel audit subsystem. AuditUID string FALSE Login UID of the process the journal entry originates from, as maintained by the kernel audit subsystem. SystemdCGroup string FALSE Control group path in the systemd hierarchy of the process the journal entry originates from. SystemdSession string FALSE Systemd session ID (if any) of the process the journal entry originates from. SystemdUnit string FALSE Systemd unit name (if any) of the process the journal entry originates from. SystemdUserUnit string FALSE Systemd user session unit name (if any) of the process the journal entry originates from. SystemdOwnerUID string FALSE Owner UID of the systemd session (if any) of the process the journal entry originates from. SystemdSlice string FALSE Systemd slice unit of the process the journal entry originates from. AuditUID string FALSE Login UID of the process the journal entry originates from, as maintained by the kernel audit subsystem. SelinuxContext string FALSE SELinux security context (label) of the process the journal entry originates from. EventTime datetime FALSE The earliest trusted timestamp of the message, if any is known that is different from the reception time of the journal. BootID string FALSE Kernel boot ID for the boot the message was generated in, formatted as a 128-bit hexadecimal string. MachineID string FALSE Machine ID of the originating host. SysInvID string FALSE Invocation ID for the runtime cycle of the unit the message was generated in, as available to processes of the unit in $INVOCATION_ID. Hostname string FALSE The name of the originating host. Transport string FALSE Transport of the entry to the journal service. Available values are: audit, driver, syslog, journal, stdout, kernel. KernelDevice string FALSE Device name of the kernel. If the entry is associated to a block device, the field contains the major and minor of the device node, separated by ":" and prefixed by "b". Similar for character devices but prefixed by "c". For network devices, this is the interface index prefixed by "n". For all other devices, this is the subsystem name prefixed by "+", followed by ":", followed by the kernel device name. KernelSubsystem string FALSE Subsystem name of the kernel. DevName string FALSE Device name of the kernel as it shows up in the device tree under the '/sys' directory. DevNode string FALSE Node path of the device under the '/dev' directory. DevLink string FALSE Additional symlink names pointing to the device node under the '/dev' directory. CoredumpUnit string FALSE Annotation to the message in case it contains coredumps from system and session units. CoredumpUserUnit string FALSE Annotation to the message in case it contains coredumps from system and session units. ObjProcessID integer FALSE This field contains the same value as the 'ProcessID', except that the process identified by PID is described, instead of the process which logged the message. ObjUser integer FALSE This field contains the same value as the 'User', except that the process identified by PID is described, instead of the process which logged the message. ObjGroup integer FALSE This field contains the same value as the 'Group', except that the process identified by PID is described, instead of the process which logged the message. ObjUser integer FALSE This field contains the same name as the 'User', except that the process identified by PID is described, instead of the process which logged the message. ObjProcessName integer FALSE This field contains the same value as the 'ProcessName', except that the process identified by PID is described, instead of the process which logged the message. ObjProcessExecutable integer FALSE This field contains the same value as the 'ProcessExecutable', except that the process identified by PID is described, instead of the process which logged the message. ObjProcessCmdLine integer FALSE This field contains the same value as the 'ProcessCmdLine', except that the process identified by PID is described, instead of the process which logged the message. ObjAuditSession integer FALSE This field contains the same value as the 'AuditSession', except that the process identified by PID is described, instead of the process which logged the message. ObjAuditUID integer FALSE This field contains the same value as the 'AuditUID', except that the process identified by PID is described, instead of the process which logged the message. ObjSystemdCGroup integer FALSE This field contains the same value as the 'SystemdCGroup', except that the process identified by PID is described, instead of the process which logged the message. ObjSystemdSession integer FALSE This field contains the same value as the 'SystemdSession', except that the process identified by PID is described, instead of the process which logged the message. ObjSystemdUnit integer FALSE This field contains the same value as the 'SystemdUnit', except that the process identified by PID is described, instead of the process which logged the message. ObjSystemdOwnerUID integer FALSE This field contains the same value as the 'SystemdOwnerUID', except that the process identified by PID is described, instead of the process which logged the message.