Add new input to Filebeat to collect entries from journald journals. The feature's already been under development. But now it's blocked.

Input files

If paths is empty, the default journal is opened. It's possible to provide directories and single journal files as inputs.

Filtering

It is possible to filter entries at journald level by providing key-value pairs. Thus, Filebeat does not need to filter at all or needs to filter less incoming events. Filter expressions needs to be match exactly the values of fields.

Example configuration

- type: journald
  paths:
    - /dev/log
    - /var/log/messages/my-journal-file
  filters:
    unit: nginx.service
    level: error

Why is it blocked?

The way journald tracks its offsets is not yet supported by Filebeat registry. Handling and saving positions if Filebeat needs a refactoring, so it becomes possible to save journald state info.