systemd Journal — Export Format Entries (log)
Five journal entries in systemd's export format — KEY=value lines separated by blank lines, with the double-underscore address fields, a syslog PRIORITY number rather than a level name, and microsecond timestamps. A parser must map priority 3 to error and 6 to info itself.
__CURSOR=s=6863c176c88b41b8a1f0d0e9d1b3a000;i=4f0;b=9c1f0a2d;m=1a2b3c00;t=63f0000;x=8a7b6c5d4e3f2a10
__REALTIME_TIMESTAMP=1773738872850000
__MONOTONIC_TIMESTAMP=182391872
_BOOT_ID=9c1f0a2d4b7e4c6f8a1b2c3d4e5f6a7b
PRIORITY=6
_UID=1000
_GID=1000
_MACHINE_ID=4f3e2d1c0b9a8776655443322110ffee
_HOSTNAME=node-a1
SYSLOG_IDENTIFIER=checkout-api
_PID=4211
MESSAGE=POST /api/checkout completed status=201 duration=148ms
__CURSOR=s=6863c176c88b41b8a1f0d0e9d1b3a001;i=4f1;b=9c1f0a2d;m=1a2b3c01;t=63f0001;x=8a7b6c5d4e3f2a11
__REALTIME_TIMESTAMP=1773738873270000
__MONOTONIC_TIMESTAMP=182811872
_BOOT_ID=9c1f0a2d4b7e4c6f8a1b2c3d4e5f6a7b
PRIORITY=4
_UID=1000
_GID=1000
_MACHINE_ID=4f3e2d1c0b9a8776655443322110ffee
_HOSTNAME=node-a1
SYSLOG_IDENTIFIER=checkout-api
_PID=4211
MESSAGE=downstream call took 71ms, budget is 50ms
__CURSOR=s=6863c176c88b41b8a1f0d0e9d1b3a002;i=4f2;b=9c1f0a2d;m=1a2b3c02;t=63f0002;x=8a7b6c5d4e3f2a12
__REALTIME_TIMESTAMP=1773738873690000
__MONOTONIC_TIMESTAMP=183231872
_BOOT_ID=9c1f0a2d4b7e4c6f8a1b2c3d4e5f6a7b
PRIORITY=3
_UID=1000
_GID=1000
_MACHINE_ID=4f3e2d1c0b9a8776655443322110ffee
_HOSTNAME=node-a1
SYSLOG_IDENTIFIER=payments-api
_PID=7452
MESSAGE=upstream POST /v1/charges timed out after 2.0s
__CURSOR=s=6863c176c88b41b8a1f0d0e9d1b3a003;i=4f3;b=9c1f0a2d;m=1a2b3c03;t=63f0003;x=8a7b6c5d4e3f2a13
__REALTIME_TIMESTAMP=1773738874110000
__MONOTONIC_TIMESTAMP=183651872
_BOOT_ID=9c1f0a2d4b7e4c6f8a1b2c3d4e5f6a7b
PRIORITY=6
_UID=1000
_GID=1000
_MACHINE_ID=4f3e2d1c0b9a8776655443322110ffee
_HOSTNAME=node-a1
SYSLOG_IDENTIFIER=systemd
_PID=1Specifications
- Entries
- 5
- Fields Per Entry
- 12
- Separator
- blank line
- Priorities Used
- 3, 4, 6
- Has Cursor Field
- true
- Timestamp Unit
- microseconds since epoch
Testing contract
Expected to pass- Scenario
- Parse the export and map each entry's PRIORITY to a severity level.
- Expected result
- Five entries are split on blank lines, the two PRIORITY=3 entries map to error and the PRIORITY=4 entry to warning, and __REALTIME_TIMESTAMP is read as microseconds rather than milliseconds.
What is a .log file?
LOG files are plain-text records of events emitted by software, typically one entry per line with a timestamp, severity, and message. There is no single standard, so formats range from unstructured text to structured JSON lines. They are central to debugging, monitoring, and auditing.
How to use this file
Use an example LOG file to test log parsers, timestamp and severity extraction, line-oriented streaming, and ingestion into monitoring or analysis pipelines.
How to use this file for testing
“systemd Journal — Export Format Entries (log)” is a deterministic Novus Examples fixture for Observability, Log parsing, Config parsing. Structured and plain-text telemetry with known timestamps, levels, request identifiers, and error states for testing log ingestion, correlation, dashboards, and alert pipelines.
Documented properties for this file: 5 entries. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
Telemetry fixtures use fixed trace IDs, span IDs, and timestamps so ingestion is reproducible run to run. Point your collector, parser, or query layer at the file and assert the documented span tree, metric families, or severity mix; service and host names are invented.
Code examples
grep -i error journald-export.log | head
awk '{print $1, $2, $NF}' journald-export.log | headRelated files
- log.NET Exception with an Inner Exception Chain (log)A .NET exception whose inner exception is introduced by the ---> marker and closed by End of inner exception stack trace, wrapped in pipe-delimited log lines. Error groupers that key on the outermost message alone merge two genuinely different faults here.
- jsonlEnvoy-Style Proxy Access Log — JSON Lines (jsonl)Forty service-mesh proxy access records with the fields that make mesh debugging possible: response_flags distinguishing an upstream failure from an overflow, upstream_service_time against total duration, upstream host and cluster, and a request ID for correlation.
- logGo Panic with Full Goroutine Dump (log)A Go panic followed by the runtime's full goroutine dump — four goroutines with their wait states, two-line frames and a created by attribution, separated by blank lines. Blank-line separation defeats multi-line rules that treat an empty line as the end of an event.
- jsonlKubernetes Audit Log — Six Events with an RBAC Denial (jsonl)Six Kubernetes audit events at two audit levels, including one 403 whose authorization annotations record the forbid decision and its reason. The shape a cluster-audit alert or compliance report reads, with every user and service account invented.
- jsonOTLP Logs — Export Document with Severity and Trace Correlation (json)An OTLP logs export across two resources: five records spanning DEBUG to FATAL with both severityNumber and severityText, separate event and observed timestamps, trace and span correlation, and one record whose body is a full multi-line Python traceback.
- logRust Panic with Numbered Backtrace (log)A Rust panic surrounded by ordinary tracing output: the panic location with line and column, a six-frame numbered backtrace where every frame spans two lines, and the RUST_BACKTRACE note. Frame numbering and the deep indent are what a generic stack parser gets wrong here.
Generated by generation/observability.py. Free for any use, no attribution required — license.