From 10d5470569f251eec2396a91548bd13cfe683f57 Mon Sep 17 00:00:00 2001 From: Tiago Queiroz Date: Mon, 30 Dec 2024 03:11:31 -0500 Subject: [PATCH] Add configuration example and improve reference (#42125) This commit adds Journald to the default `filebeat.yml` file and improves `filebeat.refenrence.yml` with all configurable options for the journald input --- .../config/filebeat.inputs.reference.yml.tmpl | 52 +++++++++++++++---- .../_meta/config/filebeat.inputs.yml.tmpl | 23 ++++++++ filebeat/filebeat.reference.yml | 52 +++++++++++++++---- filebeat/filebeat.yml | 23 ++++++++ x-pack/filebeat/filebeat.reference.yml | 52 +++++++++++++++---- x-pack/filebeat/filebeat.yml | 23 ++++++++ 6 files changed, 195 insertions(+), 30 deletions(-) diff --git a/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl b/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl index 5e44bcdb09e5..f9c703779507 100644 --- a/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl +++ b/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl @@ -771,25 +771,57 @@ filebeat.inputs: # Journald input is experimental. #- type: journald #enabled: true - #id: service-foo - # You may wish to have separate inputs for each service. You can use - # include_matches.or to specify a list of filter expressions that are - # applied as a logical OR. You may specify filter - #include_matches.match: - #- _SYSTEMD_UNIT=foo.service + # Unique ID among all inputs, if the ID changes, all entries + # will be re-ingested + id: my-journald-id - # List of syslog identifiers - #syslog_identifiers: ["audit"] + # Specify paths to read from custom journal files. + # Leave it unset to read the system's journal + # Glob based paths. + #paths: + #- /var/log/custom.journal + + # The position to start reading from the journal, valid options are: + # - head: Starts reading at the beginning of the journal. + # - tail: Starts reading at the end of the journal. + # This means that no events will be sent until a new message is written. + # - since: Use also the `since` option to determine when to start reading from. + #seek: head + + # A time offset from the current time to start reading from. + # To use since, seek option must be set to since. + #since: -24h # Collect events from the service and messages about the service, # including coredumps. - #units: ["docker.service"] + #units: + #- docker.service + + # List of syslog identifiers + #syslog_identifiers: ["audit"] # The list of transports (_TRANSPORT field of journald entries) #transports: ["audit"] - # Parsers are also supported, here is an example of the multiline + # Filter logs by facilities, they must be specified using their numeric code. + #facilities: + #- 1 + #- 2 + + # You may wish to have separate inputs for each service. You can use + # include_matches.or to specify a list of filter expressions that are + # applied as a logical OR. + #include_matches.match: + #- _SYSTEMD_UNIT=foo.service + + # Uses the original hostname of the entry instead of the one + # from the host running jounrald + #save_remote_hostname: false + + # Parsers are also supported, the possible parsers are: + # container, include_message, multiline, ndjson, syslog. + # Here is an example of the multiline # parser. #parsers: #- multiline: diff --git a/filebeat/_meta/config/filebeat.inputs.yml.tmpl b/filebeat/_meta/config/filebeat.inputs.yml.tmpl index 552988ee4483..ff091304acc4 100644 --- a/filebeat/_meta/config/filebeat.inputs.yml.tmpl +++ b/filebeat/_meta/config/filebeat.inputs.yml.tmpl @@ -41,3 +41,26 @@ filebeat.inputs: #fields: # level: debug # review: 1 + +# journald is an input for collecting logs from Journald +- type: journald + + # Unique ID among all inputs, if the ID changes, all entries + # will be re-ingested + id: my-journald-id + + # The position to start reading from the journal, valid options are: + # - head: Starts reading at the beginning of the journal. + # - tail: Starts reading at the end of the journal. + # This means that no events will be sent until a new message is written. + # - since: Use also the `since` option to determine when to start reading from. + #seek: head + + # A time offset from the current time to start reading from. + # To use since, seek option must be set to since. + #since: -24h + + # Collect events from the service and messages about the service, + # including coredumps. + #units: + #- docker.service diff --git a/filebeat/filebeat.reference.yml b/filebeat/filebeat.reference.yml index 54e3cd433b3c..b10864bdff84 100644 --- a/filebeat/filebeat.reference.yml +++ b/filebeat/filebeat.reference.yml @@ -1184,25 +1184,57 @@ filebeat.inputs: # Journald input is experimental. #- type: journald #enabled: true - #id: service-foo - # You may wish to have separate inputs for each service. You can use - # include_matches.or to specify a list of filter expressions that are - # applied as a logical OR. You may specify filter - #include_matches.match: - #- _SYSTEMD_UNIT=foo.service + # Unique ID among all inputs, if the ID changes, all entries + # will be re-ingested + id: my-journald-id - # List of syslog identifiers - #syslog_identifiers: ["audit"] + # Specify paths to read from custom journal files. + # Leave it unset to read the system's journal + # Glob based paths. + #paths: + #- /var/log/custom.journal + + # The position to start reading from the journal, valid options are: + # - head: Starts reading at the beginning of the journal. + # - tail: Starts reading at the end of the journal. + # This means that no events will be sent until a new message is written. + # - since: Use also the `since` option to determine when to start reading from. + #seek: head + + # A time offset from the current time to start reading from. + # To use since, seek option must be set to since. + #since: -24h # Collect events from the service and messages about the service, # including coredumps. - #units: ["docker.service"] + #units: + #- docker.service + + # List of syslog identifiers + #syslog_identifiers: ["audit"] # The list of transports (_TRANSPORT field of journald entries) #transports: ["audit"] - # Parsers are also supported, here is an example of the multiline + # Filter logs by facilities, they must be specified using their numeric code. + #facilities: + #- 1 + #- 2 + + # You may wish to have separate inputs for each service. You can use + # include_matches.or to specify a list of filter expressions that are + # applied as a logical OR. + #include_matches.match: + #- _SYSTEMD_UNIT=foo.service + + # Uses the original hostname of the entry instead of the one + # from the host running jounrald + #save_remote_hostname: false + + # Parsers are also supported, the possible parsers are: + # container, include_message, multiline, ndjson, syslog. + # Here is an example of the multiline # parser. #parsers: #- multiline: diff --git a/filebeat/filebeat.yml b/filebeat/filebeat.yml index aa50779b9221..a49e7bcc23a7 100644 --- a/filebeat/filebeat.yml +++ b/filebeat/filebeat.yml @@ -54,6 +54,29 @@ filebeat.inputs: # level: debug # review: 1 +# journald is an input for collecting logs from Journald +- type: journald + + # Unique ID among all inputs, if the ID changes, all entries + # will be re-ingested + id: my-journald-id + + # The position to start reading from the journal, valid options are: + # - head: Starts reading at the beginning of the journal. + # - tail: Starts reading at the end of the journal. + # This means that no events will be sent until a new message is written. + # - since: Use also the `since` option to determine when to start reading from. + #seek: head + + # A time offset from the current time to start reading from. + # To use since, seek option must be set to since. + #since: -24h + + # Collect events from the service and messages about the service, + # including coredumps. + #units: + #- docker.service + # ============================== Filebeat modules ============================== filebeat.config.modules: diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index 3e831d99fa28..5da6e5d838b9 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -2868,25 +2868,57 @@ filebeat.inputs: # Journald input is experimental. #- type: journald #enabled: true - #id: service-foo - # You may wish to have separate inputs for each service. You can use - # include_matches.or to specify a list of filter expressions that are - # applied as a logical OR. You may specify filter - #include_matches.match: - #- _SYSTEMD_UNIT=foo.service + # Unique ID among all inputs, if the ID changes, all entries + # will be re-ingested + id: my-journald-id - # List of syslog identifiers - #syslog_identifiers: ["audit"] + # Specify paths to read from custom journal files. + # Leave it unset to read the system's journal + # Glob based paths. + #paths: + #- /var/log/custom.journal + + # The position to start reading from the journal, valid options are: + # - head: Starts reading at the beginning of the journal. + # - tail: Starts reading at the end of the journal. + # This means that no events will be sent until a new message is written. + # - since: Use also the `since` option to determine when to start reading from. + #seek: head + + # A time offset from the current time to start reading from. + # To use since, seek option must be set to since. + #since: -24h # Collect events from the service and messages about the service, # including coredumps. - #units: ["docker.service"] + #units: + #- docker.service + + # List of syslog identifiers + #syslog_identifiers: ["audit"] # The list of transports (_TRANSPORT field of journald entries) #transports: ["audit"] - # Parsers are also supported, here is an example of the multiline + # Filter logs by facilities, they must be specified using their numeric code. + #facilities: + #- 1 + #- 2 + + # You may wish to have separate inputs for each service. You can use + # include_matches.or to specify a list of filter expressions that are + # applied as a logical OR. + #include_matches.match: + #- _SYSTEMD_UNIT=foo.service + + # Uses the original hostname of the entry instead of the one + # from the host running jounrald + #save_remote_hostname: false + + # Parsers are also supported, the possible parsers are: + # container, include_message, multiline, ndjson, syslog. + # Here is an example of the multiline # parser. #parsers: #- multiline: diff --git a/x-pack/filebeat/filebeat.yml b/x-pack/filebeat/filebeat.yml index aa50779b9221..a49e7bcc23a7 100644 --- a/x-pack/filebeat/filebeat.yml +++ b/x-pack/filebeat/filebeat.yml @@ -54,6 +54,29 @@ filebeat.inputs: # level: debug # review: 1 +# journald is an input for collecting logs from Journald +- type: journald + + # Unique ID among all inputs, if the ID changes, all entries + # will be re-ingested + id: my-journald-id + + # The position to start reading from the journal, valid options are: + # - head: Starts reading at the beginning of the journal. + # - tail: Starts reading at the end of the journal. + # This means that no events will be sent until a new message is written. + # - since: Use also the `since` option to determine when to start reading from. + #seek: head + + # A time offset from the current time to start reading from. + # To use since, seek option must be set to since. + #since: -24h + + # Collect events from the service and messages about the service, + # including coredumps. + #units: + #- docker.service + # ============================== Filebeat modules ============================== filebeat.config.modules: