# Elastic Agent container image cannot read logs from Journal

**URL:** <https://discuss.elastic.co/t/elastic-agent-container-image-cannot-read-logs-from-journal/372905>\
**Category:** Elastic Agent\
**Created:** [January 7, 2025, 6:56pm UTC](https://discuss.elastic.co/t/elastic-agent-container-image-cannot-read-logs-from-journal/372905 "2025-01-07T18:56:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![lpeter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lpeter/32/99176_2.png) [@lpeter](https://discuss.elastic.co/u/lpeter)\
**Post date:** [January 7, 2025, 6:56pm UTC](https://discuss.elastic.co/t/elastic-agent-container-image-cannot-read-logs-from-journal/372905/1 "2025-01-07T18:56:02Z")

</div>

Hello!

I'm fairly certain this is a bug, but on GitHub I'm told to post here, so here we go:

Since Journal logs are now read via `journalctl` ([PR](https://github.com/elastic/beats/pull/40061)) the agent container (8.17.0 for example) cannot read journal system logs mounted from the host, since `journalctl` is not available in the image.

Systemd should be installed in the image. Not pretty, but what can one do. I did a very rudimentary test, and installing `systemd` increases the current image size from 1.54G to 1.65G. I don't think it's possible to install journald/journalctl separately.

Also note that I did NOT check if installing Systemd in itself is sufficient to correctly handle host journal logs.

The most basic system integration now also supports journal as a source (which is a good thing), so I believe this should work out of the box without using a custom image.

(Btw I think reading the host journal from a container probably also breaks the current default conditions that decides which input to use [syslog or journal], but those are waaay too conservative anyway, so I have them overridden.)