bbailey
September 15, 2025, 12:56pm
1
It appears that support for journald input has been broken in release 8.19.3
This was previously fixed in version 8.18.3 (see Add systemd to Ubuntu based images by belimawr · Pull Request #44295 · elastic/beats · GitHub )
However when testing 8.19.3 I again see the error
Input 'journald' failed with: input journald failed: could not start journal reader: cannot start journalctl: exec: "journalctl": executable file not found in $PATH",
Anyone else see this ??
baoletrg
September 17, 2025, 3:32am
2
Hi I got the same issue, I changed the paths config to this and it works:
bbailey
September 17, 2025, 7:44am
3
Thanks for the work around
FYI, A regression has been confirmed by the developers and a PR is in place to fix it
8.19 ← mergify/bp/8.19/pr-44295
opened 02:41PM - 15 Sep 25 UTC
## Proposed commit message
The 8.x series uses Ubuntu as the base for the defau… lt Docker image variant, this PR adds `journalctl` (by installing `systemd`) to it.
## Checklist
- [x] My code follows the style guidelines of this project
- [ ] ~~I have commented my code, particularly in hard-to-understand areas~~
- [ ] I have made corresponding changes to the documentation
- [ ] ~~I have made corresponding change to the default configuration files~~
- [x] I have added tests that prove my fix is effective or that my feature works
- [ ] ~~I have added an entry in `CHANGELOG.next.asciidoc` or `CHANGELOG-developer.next.asciidoc`.~~
~~## Disruptive User Impact~~
~~## Author's Checklist~~
## How to test this PR locally
1. Build the Docker images
```
DEV=true SNAPSHOT=true PACKAGES="docker" PLATFORMS=linux/amd64 mage -v package
```
Validate that all, except the Wolfi variant contain the `journalctl` binary:
```
$ docker run --rm -it --entrypoint journalctl docker.elastic.co/beats/filebeat:8.18.2-SNAPSHOT --version
systemd 255 (255.4-1ubuntu8.6)
+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified
$ docker run --rm -it --entrypoint journalctl docker.elastic.co/beats/filebeat-ubi:8.18.2-SNAPSHOT --version
systemd 252 (252-46.el9_5.3)
+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN -IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT -QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified
$ docker run --rm -it --entrypoint journalctl docker.elastic.co/beats/filebeat-wolfi:8.18.2-SNAPSHOT --version
docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: exec: "journalctl": executable file not found in $PATH
Run 'docker run --help' for more information
```
## Related issues
- Relates https://github.com/elastic/beats/issues/41278
- Relates https://github.com/elastic/beats/issues/44040
~~## Use cases~~
~~## Screenshots~~
~~## Logs~~
<hr>This is an automatic backport of pull request #44295 done by [Mergify](https://mergify.com).
