Journald
Journald (journald)
Section titled “Journald (journald)”Read events from systemd-journald (Linux-only).
Linux Enterprise edition json
Minimal example
Section titled “Minimal example”input: journald: {}JSON
{ "input": { "journald": {} }}Contents
Section titled “Contents”A ✓ marks a field that accepts a context variable such as
{{ VARIABLE }}.
Behaviour
Section titled “Behaviour”Behaviour
| Field | Type | Required | Description |
|---|---|---|---|
start-at-oldest ✓ |
boolean (bool) |
Start reading from the oldest available entry (clears any saved cursor). Default: false |
|
follow-boot ✓ |
boolean (bool) |
Continue reading past boot boundaries (ignore saved cursors from previous boots). Default: false |
Debugging
Section titled “Debugging”Debugging
| Field | Type | Required | Description |
|---|---|---|---|
debug-entry-payloads ✓ |
boolean (bool) |
Emit the raw journald entry payload alongside the parsed fields (verbose). Default: false |
Filtering
Section titled “Filtering”Filtering
| Field | Type | Required | Description |
|---|---|---|---|
matches ✓ |
string[] |
Optional match filters in FIELD=VALUE form (systemd journal native syntax). |
|
units ✓ |
string[] |
Optional systemd unit names to constrain journal reads. | |
priorities ✓ |
Priorities[] |
Optional priority filters (emerg |
Schema
Section titled “Schema”Priorities Options
Section titled “Priorities Options”| Value | Aliases | Name | Description |
|---|---|---|---|
emerg |
emerg | ||
alert |
alert | ||
crit |
crit | ||
err |
err | ||
warning |
warning | ||
notice |
notice | ||
info |
info | ||
debug |
debug |