def read_field(field)
      len_ptr = FFI::MemoryPointer.new(:size_t, 1)
      out_ptr = FFI::MemoryPointer.new(:pointer, 1)
      field   = field.to_s.upcase
      rc = Native.sd_journal_get_data(@ptr, field, out_ptr, len_ptr)

      raise JournalError, rc if rc < 0

      len = len_ptr.read_size_t
      string_from_out_ptr(out_ptr, len).split('=', 2).last
    end
def read_field(field)
      len_ptr = FFI::MemoryPointer.new(:size_t, 1)
      out_ptr = FFI::MemoryPointer.new(:pointer, 1)
      field   = field.to_s.upcase
      rc = Native.sd_journal_get_data(@ptr, field, out_ptr, len_ptr)

      raise JournalError, rc if rc < 0

      len = len_ptr.read_size_t
      string_from_out_ptr(out_ptr, len).split('=', 2).last
    end
Read the contents of the provided field from the current journal entry.
   {#move_next} or {#move_previous} must be called at least once after
   initialization or seeking prior to attempting to read data.
 @param [String] field the name of the field to read.
 @return [String] the value of the requested field.
 @example Read the `MESSAGE` field from the current entry
   j = Systemd::Journal.new
   j.move_next
   puts j.read_field('MESSAGE')