The Journald input/integration is not working on some variants of the Elastic-Agent docker image.

To run the Journald input with Elastic-Agent >= 8.16.0 it is necessary to use elastic-agent-complete, currently the versions that can run the Journald input are:

• For 8.16 series >= 8.16.3
• For 8.17 series >= 8.17.1
• None of the 8.18 series can run the Journald input
• For 9.x series >= 9.0.0

Workaround

The simplest workaround is to upgrade/downgrade to a version that contains the journalctl binary (see list above)

Another option is to install the systemd package in the container or create a new image installing it. The following Dockerfile will install the systemd package in the Elastic-Agent 8.18.2 image:

FROM docker.elastic.co/elastic-agent/elastic-agent-complete:8.18.2
USER root 
RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y systemd && apt-get clean all
USER 1000

Then you can generate the new Docker image by running:

docker build -t "elastic-agent-journald:8.18.2" .

You will have to update the Dockerfile if the image you are using is not based on Ubuntu.

The fix

We have an open PR that will add support for Journald in other image variants: #7995.