elastic / elastic/integrations

[System] Investigate a better way to decide when to use Journal or Log files

Open
#18,637 5 comments 0 reactions 0 assignees View on GitHub
Team:Elastic-Agent-Data-Plane
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

This is a follow up from https://github.com/elastic/integrations/issues/10797 that provided working solution, but that is becoming hard to scale.

Currently the System integration used a handcrafted condition expression to decide whether to use Journald or Log files when collecting system logs, the current defaults look like this:
- *Journald*:
```
(${host.platform} != "windows") and (${host.os_version} == "12 (bookworm)" or ${host.os_version} == "13 (trixie)" or (${host.os_platform} == "amzn" and ${host.os_version} == "2023") or (${host.os_platform} == "sles" and (${host.os_version} == "15 SP1" or ${host.os_version} == "15 SP2" or ${host.os_version} == "15 SP3" or ${host.os_version} == "15 SP4" or ${host.os_version} == "15 SP5" or ${host.os_version} == "15 SP6" or ${host.os_version} == "15 SP7")))
```
- *Log files*:
```
(${host.platform} != "windows") and (${host.os_version} != "12 (bookworm)" and ${host.os_version} != "13 (trixie)" and (${host.os_platform} != "amzn" or ${host.os_version} != "2023") and (${host.os_platform} != "sles" and ${host.os_version} != "15 SP1" and ${host.os_version} != "15 SP2" and ${host.os_version} != "15 SP3" and ${host.os_version} != "15 SP4" and ${host.os_version} != "15 SP5" and ${host.os_version} != "15 SP6" and ${host.os_version} != "15 SP7"))
```

That is hard to understand and maintain with a another significant drawback: if an user just erases the condition, which makes the input run in all instances, upon an integration update, the empty field gets the default value, effectively overriding the user's configuration.

Currently there is a *workaround*: set the condition field to `true` (always enabled) or `false` (always disabled). Those values will persist during integration updated.

We need to design a better way to design a better way to detect and select which Linux distributions to use Journald and which ones to use Log files while also keeping the ability of allowing the user to add their own conditions.

One option that comes to mind is a sort of combo box where we show the users the distribution name and version, then under the hood we convert it into a condition expression.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.