Edge Delta Journald Source

Overview

The Journald Source node ingests log data from journald using journalctl. You can fine-tune which logs are collected by applying match expressions or filtering by systemd units. It also supports reading from non-default journal directories when needed.

• Output type: log

Example Configuration

nodes:
  - name: my_journald_input
    type: journald_input
    include:
      - "SYSLOG_IDENTIFIER=systemd,_TRANSPORT=journal"
    exclude:
      - "SYSLOG_IDENTIFIER=systemd-journald"
    include_units:
      - "systemd-journald.service"
    exclude_units:
      - "systemd.service"
    journal_namespace: "system"
    journal_directory: "/var/log/journal"
    extra_args:
      - "--no-pager"

This configuration defines a journald_input node named my_journald_input that collects logs from the system journal. It includes only entries where SYSLOG_IDENTIFIER=systemd and _TRANSPORT=journal, while excluding entries from systemd-journald. Log collection is further scoped to the systemd-journald.service unit, explicitly ignoring logs from systemd.service. It reads from the system journal namespace and uses the journal files located in /var/log/journal. The --no-pager argument ensures that journalctl outputs logs without pagination.

Required Parameters

name

A descriptive name for the node. This is the name that will appear in Visual Builder and you can reference this node in the YAML using the name. It must be unique across all nodes. It is a YAML list element so it begins with a - and a space followed by the string. It is a required parameter for all nodes.

nodes:
  - name: <node name>
    type: <node type>

type: journald_input

The type parameter specifies the type of node being configured. It is specified as a string from a closed list of node types. It is a required parameter.

nodes:
  - name: <node name>
    type: <node type>

Optional Parameters

include

Specify match expressions to include only logs that meet certain criteria. These match journalctl-style key-value filters.

nodes:
  - name: my_journald_input
    type: journald_input
    include:
      - "SYSLOG_IDENTIFIER=systemd,_TRANSPORT=journal"

exclude

Exclude any log entries that match the given expressions. Useful for suppressing noisy or unneeded sources.

nodes:
  - name: my_journald_input
    type: journald_input
    exclude:
      - "SYSLOG_IDENTIFIER=systemd-journald"

include_units

Limit log collection to specific systemd units. Only entries from these units will be processed.

nodes:
  - name: my_journald_input
    type: journald_input
    include_units:
      - "systemd-journald.service"

exclude_units

Skip log entries from the specified systemd units.

nodes:
  - name: my_journald_input
    type: journald_input
    exclude_units:
      - "systemd.service"

journal_namespace

Specify which journal namespace to use. Defaults to the system namespace unless overridden.

nodes:
  - name: my_journald_input
    type: journald_input
    journal_namespace: "system"

journal_directory

Read journal files from a specific directory instead of the system default (/run/log/journal or /var/log/journal).

nodes:
  - name: my_journald_input
    type: journald_input
    journal_directory: "/var/log/journal"

journalctl_path

If journalctl is not in your system path, use this to set its full location.

nodes:
  - name: my_journald_input
    type: journald_input
    journalctl_path: "/usr/bin/journalctl"

extra_args

Pass additional command-line arguments to the journalctl command. These will be appended to the command Edge Delta runs.

nodes:
  - name: my_journald_input
    type: journald_input
    extra_args:
      - "--no-pager"

current_boot_only

When enabled, only logs from the current system boot are collected.

nodes:
  - name: my_journald_input
    type: journald_input
    current_boot_only: true

source_metadata

The source_metadata parameter is used to define which detected resources and attributes to add to each data item as it is ingested by the Edge Delta agent. In the GUI you can select:

• Required Only: This option includes the minimum required resources and attributes for Edge Delta to operate.
• Default: This option includes the required resources and attributes plus those selected by Edge Delta
• High: This option includes the required resources and attributes along with a larger selection of common optional fields.
• Custom: With this option selected, you can choose which attributes and resources to include. The required fields are selected by default and can’t be unchecked.

Based on your selection in the GUI, the source_metadata YAML is populated as two dictionaries (resource_attributes and attributes) with Boolean values.

See Choose Data Item Metadata for more information on selecting metadata.