[{"data":1,"prerenderedAt":678},["ShallowReactive",2],{"/knowledge-base/jq-cheatsheet":3,"/knowledge-base/jq-cheatsheet-surround":669},{"id":4,"title":5,"body":6,"category":649,"contentType":650,"date":651,"description":652,"extension":653,"head":654,"image":655,"meta":656,"navigation":657,"ogImage":654,"path":658,"readingTime":659,"robots":654,"schemaOrg":654,"seo":660,"sitemap":661,"stem":662,"tags":663,"__hash__":668},"knowledgeBase/knowledge-base/jq-cheatsheet.md","Jq logs Cheat sheet",{"type":7,"value":8,"toc":634},"minimark",[9,14,23,103,108,144,148,175,179,203,207,231,234,258,262,289,293,318,322,367,371,400,403,407,410,420,444,451,483,499,520,528,557,565,595,597,601,627,630],[10,11,13],"h2",{"id":12},"file-based-logs-ndjson-jq","File-based logs (NDJSON + jq)",[15,16,17,18,22],"p",{},"Assume your log files live under ",[19,20,21],"code",{},"logs/",":",[24,25,26,39],"table",{},[27,28,29],"thead",{},[30,31,32,36],"tr",{},[33,34,35],"th",{},"File",[33,37,38],{},"Contains levels ≥ ...",[40,41,42,65,80,93],"tbody",{},[30,43,44,50],{},[45,46,47],"td",{},[19,48,49],{},"info.log",[45,51,52,55,56,55,59,55,62],{},[19,53,54],{},"info",", ",[19,57,58],{},"warn",[19,60,61],{},"error",[19,63,64],{},"fatal",[30,66,67,72],{},[45,68,69],{},[19,70,71],{},"warn.log",[45,73,74,55,76,55,78],{},[19,75,58],{},[19,77,61],{},[19,79,64],{},[30,81,82,87],{},[45,83,84],{},[19,85,86],{},"errors.log",[45,88,89,55,91],{},[19,90,61],{},[19,92,64],{},[30,94,95,100],{},[45,96,97],{},[19,98,99],{},"http.log",[45,101,102],{},"HTTP middleware entries",[104,105,107],"h3",{"id":106},"_1-follow-pretty-print-all-entries","1. Follow & pretty-print all entries",[109,110,115],"pre",{"className":111,"code":112,"language":113,"meta":114,"style":114},"language-bash shiki shiki-themes github-light github-dark github-dark","tail -f logs/info.log | jq .\n","bash","",[19,116,117],{"__ignoreMap":114},[118,119,122,126,130,134,138,141],"span",{"class":120,"line":121},"line",1,[118,123,125],{"class":124},"shcOC","tail",[118,127,129],{"class":128},"suiK_"," -f",[118,131,133],{"class":132},"sfrk1"," logs/info.log",[118,135,137],{"class":136},"so5gQ"," |",[118,139,140],{"class":124}," jq",[118,142,143],{"class":132}," .\n",[104,145,147],{"id":146},"_2-only-errors","2. Only errors",[109,149,151],{"className":111,"code":150,"language":113,"meta":114,"style":114},"tail -f logs/info.log\\\n  | jq 'select(.level==\"error\")'\n",[19,152,153,164],{"__ignoreMap":114},[118,154,155,157,159,161],{"class":120,"line":121},[118,156,125],{"class":124},[118,158,129],{"class":128},[118,160,133],{"class":132},[118,162,163],{"class":128},"\\\n",[118,165,167,170,172],{"class":120,"line":166},2,[118,168,169],{"class":136},"  |",[118,171,140],{"class":124},[118,173,174],{"class":132}," 'select(.level==\"error\")'\n",[104,176,178],{"id":177},"_3-only-pure-info-level-30","3. Only pure \"info\" (level 30)",[109,180,182],{"className":111,"code":181,"language":113,"meta":114,"style":114},"tail -f logs/info.log\\\n  | jq 'select(.level==30)'\n",[19,183,184,194],{"__ignoreMap":114},[118,185,186,188,190,192],{"class":120,"line":121},[118,187,125],{"class":124},[118,189,129],{"class":128},[118,191,133],{"class":132},[118,193,163],{"class":128},[118,195,196,198,200],{"class":120,"line":166},[118,197,169],{"class":136},[118,199,140],{"class":124},[118,201,202],{"class":132}," 'select(.level==30)'\n",[104,204,206],{"id":205},"_4-filter-by-your-service-or-key","4. Filter by your service or key",[109,208,210],{"className":111,"code":209,"language":113,"meta":114,"style":114},"tail -f logs/info.log\\\n  | jq 'select(.service==\"BOT DETECTOR\")'\n",[19,211,212,222],{"__ignoreMap":114},[118,213,214,216,218,220],{"class":120,"line":121},[118,215,125],{"class":124},[118,217,129],{"class":128},[118,219,133],{"class":132},[118,221,163],{"class":128},[118,223,224,226,228],{"class":120,"line":166},[118,225,169],{"class":136},[118,227,140],{"class":124},[118,229,230],{"class":132}," 'select(.service==\"BOT DETECTOR\")'\n",[15,232,233],{},"Or BFF util:",[109,235,237],{"className":111,"code":236,"language":113,"meta":114,"style":114},"tail -f logs/info.log\\\n  | jq 'select(.Utils==\"BFF TO API\")'\n",[19,238,239,249],{"__ignoreMap":114},[118,240,241,243,245,247],{"class":120,"line":121},[118,242,125],{"class":124},[118,244,129],{"class":128},[118,246,133],{"class":132},[118,248,163],{"class":128},[118,250,251,253,255],{"class":120,"line":166},[118,252,169],{"class":136},[118,254,140],{"class":124},[118,256,257],{"class":132}," 'select(.Utils==\"BFF TO API\")'\n",[104,259,261],{"id":260},"_5-extract-timestamp-message","5. Extract timestamp + message",[109,263,265],{"className":111,"code":264,"language":113,"meta":114,"style":114},"tail -f logs/info.log\\\n  | jq -r '.time + \" \" + .msg'\n",[19,266,267,277],{"__ignoreMap":114},[118,268,269,271,273,275],{"class":120,"line":121},[118,270,125],{"class":124},[118,272,129],{"class":128},[118,274,133],{"class":132},[118,276,163],{"class":128},[118,278,279,281,283,286],{"class":120,"line":166},[118,280,169],{"class":136},[118,282,140],{"class":124},[118,284,285],{"class":128}," -r",[118,287,288],{"class":132}," '.time + \" \" + .msg'\n",[104,290,292],{"id":291},"_6-show-only-slow-http-requests-100-ms","6. Show only slow HTTP requests (>100 ms)",[109,294,296],{"className":111,"code":295,"language":113,"meta":114,"style":114},"tail -f logs/http.log\\\n  | jq 'select(.latency > 100)'\n",[19,297,298,309],{"__ignoreMap":114},[118,299,300,302,304,307],{"class":120,"line":121},[118,301,125],{"class":124},[118,303,129],{"class":128},[118,305,306],{"class":132}," logs/http.log",[118,308,163],{"class":128},[118,310,311,313,315],{"class":120,"line":166},[118,312,169],{"class":136},[118,314,140],{"class":124},[118,316,317],{"class":132}," 'select(.latency > 100)'\n",[104,319,321],{"id":320},"_7-live-count-per-level","7. Live count per level",[109,323,325],{"className":111,"code":324,"language":113,"meta":114,"style":114},"tail -f logs/info.log\\\n  | jq -nR 'while (input?; .) | fromjson? | .level'\\\n  | sort | uniq -c\n",[19,326,327,337,351],{"__ignoreMap":114},[118,328,329,331,333,335],{"class":120,"line":121},[118,330,125],{"class":124},[118,332,129],{"class":128},[118,334,133],{"class":132},[118,336,163],{"class":128},[118,338,339,341,343,346,349],{"class":120,"line":166},[118,340,169],{"class":136},[118,342,140],{"class":124},[118,344,345],{"class":128}," -nR",[118,347,348],{"class":132}," 'while (input?; .) | fromjson? | .level'",[118,350,163],{"class":128},[118,352,354,356,359,361,364],{"class":120,"line":353},3,[118,355,169],{"class":136},[118,357,358],{"class":124}," sort",[118,360,137],{"class":136},[118,362,363],{"class":124}," uniq",[118,365,366],{"class":128}," -c\n",[104,368,370],{"id":369},"_8-grep-first-for-speed-then-jq","8. Grep first for speed, then jq",[109,372,374],{"className":111,"code":373,"language":113,"meta":114,"style":114},"grep --line-buffered '\"userService\"' logs/app.log\\\n  | jq .\n",[19,375,376,392],{"__ignoreMap":114},[118,377,378,381,384,387,390],{"class":120,"line":121},[118,379,380],{"class":124},"grep",[118,382,383],{"class":128}," --line-buffered",[118,385,386],{"class":132}," '\"userService\"'",[118,388,389],{"class":132}," logs/app.log",[118,391,163],{"class":128},[118,393,394,396,398],{"class":120,"line":166},[118,395,169],{"class":136},[118,397,140],{"class":124},[118,399,143],{"class":132},[401,402],"hr",{},[10,404,406],{"id":405},"systemd-journal-json-journalctl","🐳 systemd journal (JSON + journalctl)",[15,408,409],{},"If you've got your service running under systemd and you want the same JSON-style queries:",[411,412,413],"ol",{},[414,415,416],"li",{},[417,418,419],"strong",{},"Follow live with JSON output",[109,421,423],{"className":111,"code":422,"language":113,"meta":114,"style":114},"    journalctl -u myapp.service -f -o json\n",[19,424,425],{"__ignoreMap":114},[118,426,427,430,433,436,438,441],{"class":120,"line":121},[118,428,429],{"class":124},"    journalctl",[118,431,432],{"class":128}," -u",[118,434,435],{"class":132}," myapp.service",[118,437,129],{"class":128},[118,439,440],{"class":128}," -o",[118,442,443],{"class":132}," json\n",[411,445,446],{"start":166},[414,447,448],{},[417,449,450],{},"Pipe to jq",[109,452,454],{"className":111,"code":453,"language":113,"meta":114,"style":114},"    journalctl -u myapp.service -f -o json\\\n      | jq 'select(.MESSAGE | test(\"error\"; \"i\"))'\n",[19,455,456,473],{"__ignoreMap":114},[118,457,458,460,462,464,466,468,471],{"class":120,"line":121},[118,459,429],{"class":124},[118,461,432],{"class":128},[118,463,435],{"class":132},[118,465,129],{"class":128},[118,467,440],{"class":128},[118,469,470],{"class":132}," json",[118,472,163],{"class":128},[118,474,475,478,480],{"class":120,"line":166},[118,476,477],{"class":136},"      |",[118,479,140],{"class":124},[118,481,482],{"class":132}," 'select(.MESSAGE | test(\"error\"; \"i\"))'\n",[411,484,485],{"start":353},[414,486,487,490,491,494,495,498],{},[417,488,489],{},"Filter by priority"," (",[19,492,493],{},"0","=emerg → ",[19,496,497],{},"7","=debug)",[109,500,502],{"className":111,"code":501,"language":113,"meta":114,"style":114},"    journalctl -u myapp.service -f -p err\n",[19,503,504],{"__ignoreMap":114},[118,505,506,508,510,512,514,517],{"class":120,"line":121},[118,507,429],{"class":124},[118,509,432],{"class":128},[118,511,435],{"class":132},[118,513,129],{"class":128},[118,515,516],{"class":128}," -p",[118,518,519],{"class":132}," err\n",[411,521,523],{"start":522},4,[414,524,525],{},[417,526,527],{},"Since a time",[109,529,531],{"className":111,"code":530,"language":113,"meta":114,"style":114},"    journalctl -u myapp.service --since \"1 hour ago\" -o json | jq .\n",[19,532,533],{"__ignoreMap":114},[118,534,535,537,539,541,544,547,549,551,553,555],{"class":120,"line":121},[118,536,429],{"class":124},[118,538,432],{"class":128},[118,540,435],{"class":132},[118,542,543],{"class":128}," --since",[118,545,546],{"class":132}," \"1 hour ago\"",[118,548,440],{"class":128},[118,550,470],{"class":132},[118,552,137],{"class":136},[118,554,140],{"class":124},[118,556,143],{"class":132},[411,558,560],{"start":559},5,[414,561,562],{},[417,563,564],{},"Combine filtering",[109,566,568],{"className":111,"code":567,"language":113,"meta":114,"style":114},"    journalctl -u myapp.service -f -o json\\\n      | jq 'select(.PRIORITY>=4 and .MESSAGE | test(\"refund\"))'\n",[19,569,570,586],{"__ignoreMap":114},[118,571,572,574,576,578,580,582,584],{"class":120,"line":121},[118,573,429],{"class":124},[118,575,432],{"class":128},[118,577,435],{"class":132},[118,579,129],{"class":128},[118,581,440],{"class":128},[118,583,470],{"class":132},[118,585,163],{"class":128},[118,587,588,590,592],{"class":120,"line":166},[118,589,477],{"class":136},[118,591,140],{"class":124},[118,593,594],{"class":132}," 'select(.PRIORITY>=4 and .MESSAGE | test(\"refund\"))'\n",[401,596],{},[104,598,600],{"id":599},"tips","Tips",[602,603,604,612,620],"ul",{},[414,605,606,611],{},[417,607,608],{},[19,609,610],{},"jq -c ..."," emits compact JSON (one line), faster to tail.",[414,613,614,619],{},[417,615,616],{},[19,617,618],{},"--line-buffered"," on grep forces immediate output in pipes.",[414,621,622,623,626],{},"For systemd, ",[19,624,625],{},"-o json-pretty"," gives human-readable multiline JSON.",[15,628,629],{},"Keep this snippet handy in your terminal, and you'll have full live observability of both your file-based Pino logs and anything running under systemd.",[631,632,633],"style",{},"html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":114,"searchDepth":166,"depth":166,"links":635},[636,646],{"id":12,"depth":166,"text":13,"children":637},[638,639,640,641,642,643,644,645],{"id":106,"depth":353,"text":107},{"id":146,"depth":353,"text":147},{"id":177,"depth":353,"text":178},{"id":205,"depth":353,"text":206},{"id":260,"depth":353,"text":261},{"id":291,"depth":353,"text":292},{"id":320,"depth":353,"text":321},{"id":369,"depth":353,"text":370},{"id":405,"depth":166,"text":406,"children":647},[648],{"id":599,"depth":353,"text":600},"tools","recipe","2026-07-15","Parsing and filtering JSON logs from the command line","md",null,"/knowledge-base/jq.jpg",{},true,"/knowledge-base/jq-cheatsheet","5",{"title":5,"description":652},{"loc":658},"knowledge-base/jq-cheatsheet",[664,665,666,667],"jq","JSON","CLI","Logging","KsvBJxDv7cSeRvsnPB7yKocAF7PFFN55ww_my9z_I5E",[670,674],{"title":671,"path":672,"stem":673,"children":-1},"Introduction to iptables","/knowledge-base/iptables","knowledge-base/iptables",{"title":675,"path":676,"stem":677,"children":-1},"JWT Implementation: Refresh Tokens vs. Private Key","/knowledge-base/jwt","knowledge-base/jwt",1784306722458]