Journald

Overview

Journald collects logs from the systemd journal. It reads journal entries directly from the configured journal files or directory.

Supported platforms

• Linux: Logs
• Windows: Logs
• macOS: Logs

Basic Configuration

Parameter	Type	Default	Description
directory	string	System default journal directory	A directory containing journal files to read entries from. Relative to root_path
files	list(string)	none	A list of journal files to read entries from. Relative to root_path
units	list(string)	[]	Service Units to filter on. If not set, all units will be read.
start_at	string	end	Determines where the source starts reading the log file when it starts. Options: beginning ( Starts reading logs from the beginning of the journal files) or end (Starts reading logs from the latest entries).

Filtering to specific units

Leave units empty to read the entire journal, or list specific systemd units (for example, ssh, cron, docker, kubelet) to collect only those services' logs.

Unit names should match the systemd unit, with or without the .service suffix, as journald accepts both.

Listed units are combined with OR: an entry is collected if it belongs to any of them. The unit filter is combined with AND with the source's other filters, for example the default info priority.

{
  "units": ["ssh", "kubelet", "docker", "containerd"]
}

Note: Journald requires the journalctl binary to be available in the container or on the system. It uses journalctl to read logs from the systemd journal and does not implement its own journal reading logic.

• The system account the collector runs as must have permission to read the journal (for example via journalctl)
• In containerized environments, this typically requires root privileges and specific capabilities

Advanced Configuration

Parameter	Type	Required	Default	Description
namespace	string	No	default	Will query the given namespace. See man page systemd-journald.service(8) for details.
include_all_logs	boolean	No	false	If enabled, the source will include very long logs and logs containing unprintable characters.
persist_offsets	boolean	No	true	Stores the current reading position so the source can resume from the last processed journal entry after a restart.
retry_on_failure	boolean	No	false	Enables retry logic when reading journal entries fails due to temporary errors.

Retry On Failure Configuration

The Retry On Failure option enables automatic retry logic when Journald fails to send logs

When enabled, the source temporarily retains the log batch and attempts to resend it based on the configured retry intervals.

Parameter	Type	Default Value	Description
retry_on_failure_initial_interval	duration	1s	Time to wait after the first failure before retrying.
retry_on_failure_max_interval	duration	30s	Upper bound on retry backoff interval. Once this value is reached the delay between consecutive retries will remain constant at the specified value.
retry_on_failure_max_elapsed_time	duration	5m	Maximum amount of time (including retries) spent trying to send a logs batch to a downstream consumer. Once this value is reached, the data is discarded. Retrying never stops if set to 0.

Example Configuration

{
  "directory": "", // default: none
  "files": [], // default: none
  "units": ["ssh", "cron"], // default: [] (all units)
  "start_at": "end", // default: "end"

  "namespace": "default", // default: "default"
  "persist_offsets": true, // default: true
  "include_all_logs": false, // default: false

  "retry_on_failure": false, // default: false
  "retry_on_failure_initial_interval": "1s", // default: "1s"
  "retry_on_failure_max_interval": "30s", // default: "30s"
  "retry_on_failure_max_elapsed_time": "5m", // default: "5m"
}