How to exclude journalctl entries using a filter?

Solution 1:

No, journalctl does not support exclusion / negative filters. You will have to filter the results through jq or regular grep for now.

You can use grep for simple inverse matching -v / --invert-match, if the CONTAINER_ID is included in the text output:

journalctl -u docker -o cat --no-pager | grep -v "5d0ecb10c3c5"

for more advanced filtering, it's better to use json output:

journalctl -u docker -b -o json | jq -C . | less -R

Where you can filter messages as @programmerq suggets:

journalctl -u docker -o json | jq -cr 'select(has("CONTAINER_ID") | not) | .MESSAGE'