# Amazon linux 2023 log issue

**URL:** <https://discuss.elastic.co/t/amazon-linux-2023-log-issue/371360>\
**Category:** Elasticsearch\
**Created:** [December 3, 2024, 8:24am UTC](https://discuss.elastic.co/t/amazon-linux-2023-log-issue/371360 "2024-12-03T08:24:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahulm](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@rahulm](https://discuss.elastic.co/u/rahulm)\
**Post date:** [December 3, 2024, 8:24am UTC](https://discuss.elastic.co/t/amazon-linux-2023-log-issue/371360/1 "2024-12-03T08:24:15Z")

</div>

I have two agents that are Amazon linux 2023.  
since AL2023 stopped traditional logging and uses journald for a centralized logging, their logs are not being populated into siem.  
what is a better option?  
to install rsyslog or to collect logs from journal?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 3, 2024, 12:52pm UTC](https://discuss.elastic.co/t/amazon-linux-2023-log-issue/371360/2 "2024-12-03T12:52:05Z")

</div>

What are you using to collect the logs?

If you are using Elastic Agent, there is the [`journald`](https://www.elastic.co/docs/current/integrations/journald) integration and if you are using pure filebeat there is the [journald](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-journald.html) input.