# Filebeat Journald input still technical preview?

**URL:** <https://discuss.elastic.co/t/filebeat-journald-input-still-technical-preview/354540>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 1, 2024, 3:01pm UTC](https://discuss.elastic.co/t/filebeat-journald-input-still-technical-preview/354540 "2024-03-01T15:01:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![duncaninnes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/duncaninnes/32/132266_2.png) [@duncaninnes](https://discuss.elastic.co/u/duncaninnes)\
**Post date:** [March 1, 2024, 3:01pm UTC](https://discuss.elastic.co/t/filebeat-journald-input-still-technical-preview/354540/1 "2024-03-01T15:01:53Z")

</div>

I see from the docs that the Journald input for Filebeat is still in techncial preview? How long is it expected to stay in technical preview?

It's not like Journald is new or anything? Have been waiting on the ability to ingest journald logs for 9 years now 😮‍💨

---

<div class="post-metadata">

**Author:** ![mrflibble](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mrflibble](https://discuss.elastic.co/u/mrflibble)\
**Post date:** [March 1, 2024, 4:26pm UTC](https://discuss.elastic.co/t/filebeat-journald-input-still-technical-preview/354540/2 "2024-03-01T16:26:56Z")

</div>

@duncaninnes it sounds like it's close - I've been troubleshooting a journald input issue recently which led me to this, where devs discuss the remaining blockers to going GA:

> <https://github.com/elastic/beats/issues/37086>
>
> \- Relates https://github.com/elastic/elastic-agent/issues/3650
> 
> As of Debian 1…2 system logs are exclusively available via journald by default. Today we support reading journald logs via the Filebeat \[journald input\](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-journald.html), which is still in technical preview and has several major bugs filed against it. See https://github.com/elastic/beats/issues?q=is%3Aissue+is%3Aopen+journald notably:
> 
> \- \[\] https://github.com/elastic/beats/issues/34077
> \- \[\] https://github.com/elastic/beats/issues/32782
> \- \[\] https://github.com/elastic/beats/issues/30398
> 
> We need to provide a GA way to read journald logs. There are two paths to this:
> 
> 1. Fix the major issues in the journald input and GA it as is. All integrations that previously read syslog files by default will need a conditional to specify that journald should be used instead of one of the log files on Linux (see \[example\](https://github.com/elastic/integrations/blob/9dcd6eac196eed413eff898c1ecbc46fe1d745e1/packages/iptables/data\_stream/log/agent/stream/journald.yml.hbs#L1). Possibly this conditional will need to be on the Linux distribution and not just Linux as a platform.
> 2. ~Fold the existing journald functionality into filestream, so that there is only one way to read log files and all existing uses of filestream to read system logs continue to work with no or minimal modification. In the ideal case we detect we are reading journald logs based on a .journal extension or well known file paths, but we may need a configuration flag for this. If we do end up with a configuration flag we could consider implementing journald support as a type of parser https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#\_parsers~
> 
> Edit:
> Option 1 is the path forward, we'll keep the separate journald input.
> 
> To close this issue we'll need to:
> 
> 
> \`\`\`\[tasklist\]
> \### Tasks
> \- \[\] https://github.com/elastic/beats/issues/34077
> \- \[\] https://github.com/elastic/beats/issues/32782
> \- \[\] https://github.com/elastic/beats/issues/30398
> \- \[\] https://github.com/elastic/beats/issues/37876
> \- \[\] https://github.com/elastic/beats/issues/37877
> \- \[\] https://github.com/elastic/integrations/issues/9067
> \`\`\`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2024, 6:27pm UTC](https://discuss.elastic.co/t/filebeat-journald-input-still-technical-preview/354540/3 "2024-03-29T18:27:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.