Filter JSON Logs by Field with jq

← All posts

Terminal filtering JSON logs to show only error entries using jq

Bash

jq -r 'select(.level == "error") | [.timestamp, .message] | @tsv' app.log

I reach for this when I’m staring at a noisy JSON log file and only care about a specific subset — typically errors. This command uses jq to filter objects where .level == "error", then extracts the timestamp and message fields, and finally formats them as tab-separated values.

Breaking it down:

select(.level == "error") filters the stream to only matching objects.
[.timestamp, .message] builds a new array with just the fields I care about.
@tsv renders that array as tab-separated output (great for piping into column -t or saving to a file).
-r outputs raw strings instead of JSON-encoded strings.

This assumes your log file (app.log) is newline-delimited JSON (one JSON object per line), which is common for structured logging. If your logs are wrapped in a top-level array, you’ll need to prefix the filter with .[] |.

When debugging production issues, this one-liner saves me from scrolling through thousands of lines. Pipe it into sort, uniq, or less depending on what you’re chasing.