# \`include\_matches.match\` has no effect with journal fields (config included)

**URL:** <https://discuss.elastic.co/t/include-matches-match-has-no-effect-with-journal-fields-config-included/380701>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 3, 2025, 7:35pm UTC](https://discuss.elastic.co/t/include-matches-match-has-no-effect-with-journal-fields-config-included/380701 "2025-08-03T19:35:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NominaSumpta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nominasumpta/32/52412_2.png) [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\
**Post date:** [August 3, 2025, 7:35pm UTC](https://discuss.elastic.co/t/include-matches-match-has-no-effect-with-journal-fields-config-included/380701/1 "2025-08-03T19:35:59Z")

</div>

**Is this a documentation bug, or a Filebeat bug?**

This is an example from the [Filebeat documentation](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-journald):

```auto
filebeat.inputs:
- type: journald
  id: service-vault
  include_matches.match:
    - _SYSTEMD_UNIT=vault.service

```

Applying `include_matches.match` has no effect. Messages for **all** units are shipped.

This seems to be the case for all journal fields. For example, `_TRANSPORT=kernel` has no effect either.

Using `journalctl -o json`, I can confirm that `_SYSTEMD_UNIT` is set for the unit I'm targeting (even though absence should not cause logs for all units to be shipped).

`processors` (e.g. `when.not.regexp.message: '^iptables'`) does work.

Versions:

- Filebeat 7.17.29
- systemd 252 (252.38-1~deb12u1)

--

`filebeat.yml`:

```yaml
monitoring:
  enabled: true
  cluster_uuid: <stripped>
  elasticsearch:
    username: elastic
    password: <stripped>
    hosts: ["elasticsearch-test.cyberfusion.cloud:9200"]
    protocol: https
    ssl:
      enabled: true

output.logstash:
  hosts: ["domlimev.nl:5044"]
  ssl.ssl: true

filebeat.config.inputs:
  enabled: true
  path: inputs.d/*.yml

# inputs.d/daemons.yml (only file in inputs.d/)

- type: journald
  id: ssh
  include_matches.match:
      - _SYSTEMD_UNIT=sshd.service

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [August 4, 2025, 5:33am UTC](https://discuss.elastic.co/t/include-matches-match-has-no-effect-with-journal-fields-config-included/380701/2 "2025-08-04T05:33:26Z")

</div>

Hello @NominaSumpta

As per the syntax shared :

```auto
filebeat.inputs:
- type: journald
  id: service-vault
  include_matches.match:
    - _SYSTEMD_UNIT=vault.service

```

This is for 8.19 version =\>

> **[Journald input | Filebeat Reference \[8.19\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/8.19/filebeat-input-journald.html)**

But since your version is 7.17.x

I see below syntax :

```auto
filebeat.inputs:
- type: journald
  id: service-vault
  include_matches:
    - _SYSTEMD_UNIT=vault.service

```

> **[Journald input | Filebeat Reference \[7.17\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-input-journald.html)**

Could you please try this & see if it works (there is no .match)

Thanks!!

---

<div class="post-metadata">

**Author:** ![NominaSumpta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nominasumpta/32/52412_2.png) [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\
**Post date:** [August 4, 2025, 8:26am UTC](https://discuss.elastic.co/t/include-matches-match-has-no-effect-with-journal-fields-config-included/380701/3 "2025-08-04T08:26:42Z")

</div>

Hi @Tortoise,

You're absolutely right. No clue how I missed that. Thanks so much!