elastic / elastic/integrations
[System]: "Seek" and "since" configurations of Journald input should be exposed
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
### Integration Name
System [system]
### Dataset Name
_No response_
### Integration Version
1.67.3
### Agent Version
8.17.4
### OS Version and Architecture
Ubuntu 24.04 LTS and others
### User Goal
Currently when the System integration (with Journal reading) is assigned to a new agent the logs are processed from the beginning of time, which can be problematic due to the sheer amount of system logs. I believe this is due to the (not very well documented) default value of the [`seek` configuration](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-journald#filebeat-input-journald-seek), which I believe to be `head` based just on the observed behaviour. It would be nice to be able to change this to `tail` or `since`.
This behaviour is especially problematic when an agent is reassigned to a new policy which also has the System integration enabled. This will cause all system logs to be reread, since the Journald input will have a different `id`. So the exposure of the `id` could also be considiered, but it might be a more involved tasks since I think the input ids are current generated by the agent (not entirely sure how it works).
This issue most likely affects all integrations where the Journald input is used.
### Existing Features
n/a
### What did you see?
n/a
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.