Building filebeat with journald support for arm

[Marko_Todoric]

Hello everyone,

I've been struggling to figure out how to compile filebeat with support for journald for arm platform.
I know it seems to not be officially supported (since there are no arm packages available to download officially) but it does seem to work when i compile it.

I've been following this guide -> Contributing to Beats | Beats Developer Guide [master] | Elastic to build however I was running into few problems:

I'm building this on arm64 ec2 instance since it's a lot faster then actually building on raspberry pi.
I'm trying to compile it for arm (not arm64). When running:

mage build

As described in contributing documentation, it builds for arm64, ofcourse - as expected.

When trying to build it with

GOOS=linux GOARCH=arm CGO_ENABLED=1 mage build
<or>
GOOS=linux GOARCH=arm mage build

It fails build with gcc: error: unrecognized command line option '-marm'

When building with go build using:

GOOS=linux GOARCH=arm go build

It manages to compile it successfully and filestream input works, but when i try to use journald input it says No such input type exist: 'journald'.
I tried crossBuild with mage - it builds only for arm64 doesn't even try arm.

Eventually i tried to compile with go build -x (which is verbose output) to try to get some errors possibly but cannot see anything error related to journald and does try to compile it.

I would really appreciate some help on this

[TiagoQueiroz]

Hi @Marko_Todoric,

The journald input is behind a build tag because it required CGO and only works on Linux.

To build it, you need to add -tags=linux,cgo,withjournald to your go build command.

You will also need to have some journald packages installed on your build machine.

[Marko_Todoric]

I was building on linux and actually tried with -tags=withjournald (however without linux and cgo since it was already in env var) and also didn't work.

What eventually managed to get it to work was to use crossBuild target for mage but with specifying linux/armv7 in PLATFORMS variable, however on a x64 vm, not arm64.

Specifically

PLATFORMS="linux/armv7" mage crossBuild

Now it managed to compile with journald input and i obtained arm executable, now i have a different problem but that's for another thread thanks for quick reply!