# 🛠️ Wazuh Logs Advanced Log Troubleshooting (with JQ)
#
The Wazuh Dashboard logs are JSON-formatted, but standard `journalctl` prepends timestamps that break JSON parsers. Use these commands to see perfectly formatted, readable logs.
### View Pretty-Printed JSON
The `-o cat` flag removes the OS timestamps, allowing `jq` to parse the dashboard's internal JSON correctly.
```
sudo journalctl -u wazuh-dashboard -o cat -f | jq '.'
```
### Extract Only Timestamps and Messages
If you want a very clean list of just the time and the action being performed, use this `jq` filter.
```
sudo journalctl -u wazuh-dashboard -o cat -f | jq -r '"[\(."@timestamp")] \( .message)"'
```
### Handling Non-JSON Errors
Sometimes the system outputs non-JSON errors (like service start failures). If the commands above fail, fall back to the raw log.
```
sudo journalctl -u wazuh-dashboard -e --no-pager
```
#### ✅ Resulting Output
By using `-o cat`, you ensure that every line passed to `jq` starts with `{`, eliminating the `parse error` you encountered.