Manipulating journalctl output

[Tom H]

On Thu, Jan 2, 2014 at 10:32 AM, Suvayu Ali <fatkasuvayu+linux at gmail.com> wrote:
> On Thu, Jan 02, 2014 at 03:20:38AM +0000, Tom H wrote:
>> On Thu, Jan 2, 2014 at 3:00 AM, Tom H <tomh0665 at gmail.com> wrote:
>>> On Wed, Jan 1, 2014 at 7:57 PM, Suvayu Ali <fatkasuvayu+linux at gmail.com> wrote:
>>>>
>>>> 2. I would like to filter logs that typically go into /var/log/secure
>>>> (or other similar files); how do I do that?
>>>
>>> SYSLOG_FACILITY=authpriv
>>
>> Sorry. Just thought that I'd try it and it turms out that it takes the
>> facility as a number not as a name, so "SYSLOG_FACILITY=10".
>
> Thank you! This will be very helpful. Where is this documented? I
> could not find this information in journalctl(1) or
> systemd.jounal-fields(7); did I miss some other docs?

That SYSLOG_FACILITY has to be a number is from systemd.jounal-fields(7).