Skip to content

Journald

Journald (journald)

Read events from systemd-journald (Linux-only).

Linux json

Minimal example

input:
journald: {}
JSON
{
"input": {
"journald": {}
}
}

Contents

Behaviour

Behaviour
FieldTypeRequiredDescription
start-at-oldestboolean (bool)Start reading from the oldest available entry (clears any saved cursor).
Default: false
follow-bootboolean (bool)Continue reading past boot boundaries (ignore saved cursors from previous boots).
Default: false

Debugging

Debugging
FieldTypeRequiredDescription
debug-entry-payloadsboolean (bool)Emit the raw journald entry payload alongside the parsed fields (verbose).
Default: false

Filtering

Filtering
FieldTypeRequiredDescription
matchesstring[]Optional match filters in FIELD=VALUE form (systemd journal native syntax).
unitsstring[]Optional systemd unit names to constrain journal reads.
prioritiesPriorities[]Optional priority filters (emerg

Schema

Priorities Options

ValueNameDescription
emergemergEmerg
alertalertAlert
critcritCrit
errerrErr
warningwarningWarning
noticenoticeNotice
infoinfoInfo
debugdebugDebug