Journald
Journald (journald)
Read events from systemd-journald (Linux-only).
Linux json
Minimal example
input: journald: {}JSON
{ "input": { "journald": {} }}Contents
Behaviour
Behaviour
| Field | Type | Required | Description |
|---|---|---|---|
start-at-oldest ✓ | boolean (bool) | Start reading from the oldest available entry (clears any saved cursor). Default: false | |
follow-boot ✓ | boolean (bool) | Continue reading past boot boundaries (ignore saved cursors from previous boots). Default: false |
Debugging
Debugging
| Field | Type | Required | Description |
|---|---|---|---|
debug-entry-payloads ✓ | boolean (bool) | Emit the raw journald entry payload alongside the parsed fields (verbose). Default: false |
Filtering
Filtering
| Field | Type | Required | Description |
|---|---|---|---|
matches ✓ | string[] | Optional match filters in FIELD=VALUE form (systemd journal native syntax). | |
units ✓ | string[] | Optional systemd unit names to constrain journal reads. | |
priorities ✓ | Priorities[] | Optional priority filters (emerg |
Schema
Priorities Options
| Value | Name | Description |
|---|---|---|
emerg | emerg | Emerg |
alert | alert | Alert |
crit | crit | Crit |
err | err | Err |
warning | warning | Warning |
notice | notice | Notice |
info | info | Info |
debug | debug | Debug |