@NewDwarf that didn't work for some reason, it gave the following;
log show --process 0 -last 15m | grep ahkinject
log: unrecognized option `--process'
usage: log show [options] <archive>
  or: log show [options]
description:
  Show the contents of the system log datastore or a log archive.
  Output contains only default level messages unless --info and/or
  --debug are specified.
options:
  --[no-]backtrace       Control whether backtraces are shown
  --[no-]debug         Control whether "Debug" events are shown
  --[no-]info          Control whether "Info" events are shown
  --[no-]loss          Control whether message loss events are shown
  --[no-]signpost        Control whether signposts are shown
  --color <mode>        Control color output (valid: auto, always, none)
  --end <date>         Display events up to the given end date
  --last <num>[m|h|d]      Display recent events up to the given limit
  --[no-]pager         Paginate output using less.
  --predicate <predicate>    Filter events using the given predicate
  --source           Annotate output with source file and line-number
  --start <date>        Display events from the given start date
  --style <style>        Output format (valid: default, syslog, json, ndjson, compact)
  --timezone local | <tz>    Use the given timezone when displaying event timestamps
  --mach-continuous-time    Print mach continuous time timestamps rather than walltime
valid time formats:
  'Y-M-D H:m:s+zzzz', 'Y-M-D H:m:s', 'Y-M-D', '@unixtime'
predicate usage:
  Filter predicates follow the NSPredicate format described at:
  https://developer.apple.com/library/content/documentation/Cocoa/Conceptual/Predicates/AdditionalChapters/Introduction.html
  For predicate field/type details, see `log help predicates`.
