elastic / elastic/integrations
[System] Investigate a better way to decide when to use Journal or Log files
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
This is a follow up from https://github.com/elastic/integrations/issues/10797 that provided working solution, but that is becoming hard to scale.
Currently the System integration used a handcrafted condition expression to decide whether to use Journald or Log files when collecting system logs, the current defaults look like this:
- *Journald*:
```
(${host.platform} != "windows") and (${host.os_version} == "12 (bookworm)" or ${host.os_version} == "13 (trixie)" or (${host.os_platform} == "amzn" and ${host.os_version} == "2023") or (${host.os_platform} == "sles" and (${host.os_version} == "15 SP1" or ${host.os_version} == "15 SP2" or ${host.os_version} == "15 SP3" or ${host.os_version} == "15 SP4" or ${host.os_version} == "15 SP5" or ${host.os_version} == "15 SP6" or ${host.os_version} == "15 SP7")))
```
- *Log files*:
```
(${host.platform} != "windows") and (${host.os_version} != "12 (bookworm)" and ${host.os_version} != "13 (trixie)" and (${host.os_platform} != "amzn" or ${host.os_version} != "2023") and (${host.os_platform} != "sles" and ${host.os_version} != "15 SP1" and ${host.os_version} != "15 SP2" and ${host.os_version} != "15 SP3" and ${host.os_version} != "15 SP4" and ${host.os_version} != "15 SP5" and ${host.os_version} != "15 SP6" and ${host.os_version} != "15 SP7"))
```
That is hard to understand and maintain with a another significant drawback: if an user just erases the condition, which makes the input run in all instances, upon an integration update, the empty field gets the default value, effectively overriding the user's configuration.
Currently there is a *workaround*: set the condition field to `true` (always enabled) or `false` (always disabled). Those values will persist during integration updated.
We need to design a better way to design a better way to detect and select which Linux distributions to use Journald and which ones to use Log files while also keeping the ability of allowing the user to add their own conditions.
One option that comes to mind is a sort of combo box where we show the users the distribution name and version, then under the hood we convert it into a condition expression.
Contributor guide
Assessment
This issue has not been assessed yet.