I've seen a couple of already closed topics, with no real result about the JournalD input of Filebeat and its support for multiline messages or even the newly added parser support.
There exists a couple of GitHub issues regarding this topic like:
- [Journalbeat] Still no multiline support after 3 years · Issue #27578 · elastic/beats · GitHub
- [filebeat] Add multiline support for journald input · Issue #29907 · elastic/beats · GitHub
Both of them are closed but there exists no real statement if multiline or parser support will be added to the journalD input or what is currently blocking it. As the journal exists now a couple of years and a lot of Linux distributions are using journald for collecting the looks internally it would be really helpful if Filebeat has also full support for this. Or if at least someone from Elastic can give a statement what will is being planned with the input in the future.