# How to gather journald logs from coreos hosts in an Openshift cluster? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 4, 2020, 2:04pm UTC](https://discuss.elastic.co/t/how-to-gather-journald-logs-from-coreos-hosts-in-an-openshift-cluster/247553 "2020-09-04T14:04:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [September 4, 2020, 2:04pm UTC](https://discuss.elastic.co/t/how-to-gather-journald-logs-from-coreos-hosts-in-an-openshift-cluster/247553/1 "2020-09-04T14:04:10Z")
Hello, We are in the process of migrating from Openshift 3.11 to Openshift 4.5. We managed to get the Filebeat daemonset working to ship pod logs, but we also need to index the journalctl logs from the coreos hosts. What is currently the recommended way to do this? Should we use Journalbeat? As a daemonset? I read something about a journald module for Filebeat, but this module hasn't been released apparently. > > > Add new input to Filebeat to collect entries from journald journals. The feature's already been under development. But now it's blocked. > Input... Please suggest how we can index journald logs from the coreos hosts. Thanks. Willem ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [September 17, 2020, 10:30am UTC](https://discuss.elastic.co/t/how-to-gather-journald-logs-from-coreos-hosts-in-an-openshift-cluster/247553/2 "2020-09-17T10:30:12Z")
Anyone? ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [September 21, 2020, 1:13pm UTC](https://discuss.elastic.co/t/how-to-gather-journald-logs-from-coreos-hosts-in-an-openshift-cluster/247553/3 "2020-09-21T13:13:02Z")
For the time being, we recommend you use Journalbeat. However, keep in mind that `journald` input in Filebeat is implemented and backported to 7.x: [https://github.com/elastic/beats/tree/7.x/filebeat/input/journald](https://github.com/elastic/beats/tree/7.x/filebeat/input/journald) Unfortunately, it is not yet ready for release, but we would like to get it out as soon as possible. ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [September 21, 2020, 2:05pm UTC](https://discuss.elastic.co/t/how-to-gather-journald-logs-from-coreos-hosts-in-an-openshift-cluster/247553/4 "2020-09-21T14:05:11Z")
Thanks for your answer @kvch > [@kvch](#): > > Unfortunately, it is not yet ready for release, but we would like to get it out as soon as possible. Looking forward to that. Is there a GitHub issue for this? Can we install Journalbeat as a daemonset? Because there is no way to install packages on our coreos hosts. I cannot find any documentation about how to do this in [https://www.elastic.co/guide/en/beats/journalbeat/master/running-with-systemd.html](https://www.elastic.co/guide/en/beats/journalbeat/master/running-with-systemd.html) ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [October 15, 2020, 6:51pm UTC](https://discuss.elastic.co/t/how-to-gather-journald-logs-from-coreos-hosts-in-an-openshift-cluster/247553/5 "2020-10-15T18:51:39Z")
@kvch > Is there a GitHub issue for this? > Can we install Journalbeat as a daemonset? Tx Willem ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 12, 2020, 8:51pm UTC](https://discuss.elastic.co/t/how-to-gather-journald-logs-from-coreos-hosts-in-an-openshift-cluster/247553/6 "2020-11-12T20:51:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.