# Systemd missing from filebeat in version 8.19.3 **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 15, 2025, 12:56pm UTC](https://discuss.elastic.co/t/systemd-missing-from-filebeat-in-version-8-19-3/381952 "2025-09-15T12:56:51Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![bbailey](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Post date:** [September 15, 2025, 12:56pm UTC](https://discuss.elastic.co/t/systemd-missing-from-filebeat-in-version-8-19-3/381952/1 "2025-09-15T12:56:51Z")
It appears that support for journald input has been broken in release 8.19.3 This was previously fixed in version 8.18.3 (see [Add systemd to Ubuntu based images by belimawr · Pull Request #44295 · elastic/beats · GitHub](https://github.com/elastic/beats/pull/44295)) However when testing 8.19.3 I again see the error Input 'journald' failed with: input journald failed: could not start journal reader: cannot start journalctl: exec: "journalctl": executable file not found in $PATH", Anyone else see this ?? ---
**Author:** ![baoletrg](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@baoletrg](https://discuss.elastic.co/u/baoletrg)\ **Post date:** [September 17, 2025, 3:32am UTC](https://discuss.elastic.co/t/systemd-missing-from-filebeat-in-version-8-19-3/381952/2 "2025-09-17T03:32:41Z")
Hi I got the same issue, I changed the paths config to this and it works: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/47f308fd9030278df7e66e1e8fb90264b89dacbd.png) ---
**Author:** ![bbailey](https://avatars.discourse-cdn.com/v4/letter/b/ebca7d/32.png) [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Post date:** [September 17, 2025, 7:44am UTC](https://discuss.elastic.co/t/systemd-missing-from-filebeat-in-version-8-19-3/381952/3 "2025-09-17T07:44:26Z")
Thanks for the work around FYI, A regression has been confirmed by the developers and a PR is in place to fix it > > > \## Proposed commit message > > The 8.x series uses Ubuntu as the base for the defau…lt Docker image variant, this PR adds \`journalctl\` (by installing \`systemd\`) to it. > > \## Checklist > > \- \[x\] My code follows the style guidelines of this project > \- \[\] ~~I have commented my code, particularly in hard-to-understand areas~~ > \- \[\] I have made corresponding changes to the documentation > \- \[\] ~~I have made corresponding change to the default configuration files~~ > \- \[x\] I have added tests that prove my fix is effective or that my feature works > \- \[\] ~~I have added an entry in \`CHANGELOG.next.asciidoc\` or \`CHANGELOG-developer.next.asciidoc\`.~~ > > ~~## Disruptive User Impact~~ > ~~## Author's Checklist~~ > > \## How to test this PR locally > 1. Build the Docker images > \`\`\` > DEV=true SNAPSHOT=true PACKAGES="docker" PLATFORMS=linux/amd64 mage -v package > \`\`\` > > Validate that all, except the Wolfi variant contain the \`journalctl\` binary: > \`\`\` > $ docker run --rm -it --entrypoint journalctl docker.elastic.co/beats/filebeat:8.18.2-SNAPSHOT --version > systemd 255 (255.4-1ubuntu8.6) > +PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF\_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified > > $ docker run --rm -it --entrypoint journalctl docker.elastic.co/beats/filebeat-ubi:8.18.2-SNAPSHOT --version > systemd 252 (252-46.el9\_5.3) > +PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN -IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT -QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF\_FRAMEWORK +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified > > $ docker run --rm -it --entrypoint journalctl docker.elastic.co/beats/filebeat-wolfi:8.18.2-SNAPSHOT --version > docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: exec: "journalctl": executable file not found in $PATH > > Run 'docker run --help' for more information > \`\`\` > > \## Related issues > > \- Relates https://github.com/elastic/beats/issues/41278 > \- Relates https://github.com/elastic/beats/issues/44040 > > > ~~## Use cases~~ > ~~## Screenshots~~ > ~~## Logs~~ > > \This is an automatic backport of pull request #44295 done by \[Mergify\](https://mergify.com).