Skip to content

[9.3](backport #48203) [Filebeat/Journald] Improve documentation #48358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pierrehilbert merged 1 commit into from
Jan 9, 2026
Merged

[9.3](backport #48203) [Filebeat/Journald] Improve documentation #48358

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/reference/filebeat/filebeat-input-journald.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,9 @@ applies_to:
[`journald`](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) is a system service that collects and stores logging data. The `journald` input reads this log data and the metadata associated with it. To read this log data Filebeat calls `journalctl` to read from the journal, therefore Filebeat needs permission to execute `journalctl`.

:::{warning}
The Wolfi-based Docker image does not contain the `journalctl` binary and the `journald` input type cannot be used with it.
The Wolfi-based Docker image does not contain the `journalctl` binary.

{applies_to}`stack: ga 9.3.0` To use the `journald` input type with Wolfi images, you must configure the [`chroot`](#filebeat-input-journald-chroot) option to use the host's `journalctl` binary.
:::

:::{important}
Expand All @@ -32,8 +34,6 @@ either:

:::

If the `journalctl` process exits unexpectedly the journald input will terminate with an error and Filebeat will need to be restarted to start reading from the journal again.

The simplest configuration example is one that reads all logs from the default journal.

```yaml
Expand Down
Loading