# Filebeat and journald?

**URL:** <https://discuss.elastic.co/t/filebeat-and-journald/49978>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 13, 2016, 9:06am UTC](https://discuss.elastic.co/t/filebeat-and-journald/49978 "2016-05-13T09:06:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Devnull](https://avatars.discourse-cdn.com/v4/letter/d/c89c15/32.png) [@Devnull](https://discuss.elastic.co/u/Devnull)\
**Post date:** [May 13, 2016, 9:06am UTC](https://discuss.elastic.co/t/filebeat-and-journald/49978/1 "2016-05-13T09:06:17Z")

</div>

Hi,

I've recently been upgrading a few Ubuntu Servers to 16.04LTS and I notice they've been shifting towards systemd and its associated journald for logging.

Does anything special need to be done with Filebeat (or indeed, do I need to wait for Elastic to integrate support) ?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 13, 2016, 1:42pm UTC](https://discuss.elastic.co/t/filebeat-and-journald/49978/2 "2016-05-13T13:42:08Z")

</div>

What does your current setup look like? As long as journald writes the logs to files, Filebeat can pick up the files.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 17, 2016, 10:52am UTC](https://discuss.elastic.co/t/filebeat-and-journald/49978/3 "2016-05-17T10:52:03Z")

</div>

Journald is using some binary format which is not understood by filebeat. Another option is to configure journald to use syslog output. Maybe the logstash syslog input plugin can be used here or use syslog to write logs to local file to be pushed by filebeat.

There's also a community beat supporting journald, but I never tried to build this myself: [https://github.com/mheese/journalbeat](https://github.com/mheese/journalbeat)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/filebeat-and-journald/49978/4 "2017-07-05T21:51:55Z")

</div>


