Ingest journald logs with filebeat

OpenSearch
, ,
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch: 2.17
Opensearch Dashboards: 2.17
Server OS: RHEL 9.6
Browser: Google Chrome 137.0.7151.69
Filebeat OSS 7.12.1

Describe the issue:
Hi !

How do I ingest messages from journald logs into Opensearch using filebeat oss 7.12.1 ?
What do I have to configure in the filebeat.yaml ?

The journald logs are written by a container running as non-root user.

Is there a better ingestion tool ?

Thnx for any help !

Best regards, Detlef

2

@Detlef You could use Journald input in Filebeat, but that’s available in version 7.16
What is your workflow? Do you use Logstash or ingest directly to OS?

3

@pablo: I ingest directly to OS. Journald input is not available in the filebeat version 7.12.1. I got the information about the filebeat version to use from Agents and ingestion tools - OpenSearch documentation .

4

@Detlef That is correct, but you could use Logstash with OpenSearch Output plugin and then switch to the newer version of the Filebeat.