elastic / elastic/integrations

[System]: "Seek" and "since" configurations of Journald input should be exposed

Open
#13,635 1 comment 0 reactions 0 assignees View on GitHub
Integration:system needs:triage Stalled Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

### Integration Name

System [system]

### Dataset Name

_No response_

### Integration Version

1.67.3

### Agent Version

8.17.4

### OS Version and Architecture

Ubuntu 24.04 LTS and others

### User Goal

Currently when the System integration (with Journal reading) is assigned to a new agent the logs are processed from the beginning of time, which can be problematic due to the sheer amount of system logs. I believe this is due to the (not very well documented) default value of the [`seek` configuration](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-journald#filebeat-input-journald-seek), which I believe to be `head` based just on the observed behaviour. It would be nice to be able to change this to `tail` or `since`.

This behaviour is especially problematic when an agent is reassigned to a new policy which also has the System integration enabled. This will cause all system logs to be reread, since the Journald input will have a different `id`. So the exposure of the `id` could also be considiered, but it might be a more involved tasks since I think the input ids are current generated by the agent (not entirely sure how it works).

This issue most likely affects all integrations where the Journald input is used.

### Existing Features

n/a

### What did you see?

n/a

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.