Show journal logs from the time a service was restarted

You can use the invocation id, which is a unique identifier for a specific run of a service unit.

It was introduced in systemd v232, so you need at least that version of systemd for this to work.

To get the invocation id of the current run of the service:

$ unit=prometheus
$ systemctl show -p InvocationID --value "$unit"
0e486642eb5b4caeaa5ed1c56010d5cf

And then to search journal entries with that invocation id attached to them:

$ journalctl INVOCATION_ID=0e486642eb5b4caeaa5ed1c56010d5cf + _SYSTEMD_INVOCATION_ID=0e486642eb5b4caeaa5ed1c56010d5cf

I found that you need both INVOCATION_ID and _SYSTEMD_INVOCATION_ID to get all the logs. The latter is added by systemd for logs output by the unit itself (e.g. the stdout of the process running in that service), while the former is attached to events taken by systemd (e.g. "Starting" and "Started" messages for that unit.)

Note that you don't need to filter by the unit name as well. Since the invocation id is unique, filtering by the id itself is sufficient to only include logs for the service you're interested in.