Tiago Queiroz

Make Journald input resilient to Journald errors

1

Currently if there is any error reading the next message from Journald, the input will stop working and never recover, effectively stopping ingestion and never recovering. This happens because any...

[Journald] input crashes with "failed to read message field: cannot allocate memory"

1

Filebat: 8.13.2 Host OS: Amazon Linux 2 Systemd/Journald version: systemd 252 (252.16-1.amzn2023.0.2) ``` journalctl --version systemd 252 (252.16-1.amzn2023.0.2) +PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP -GCRYPT -GNUTLS +OPENSSL +ACL +BLKID...

Only start Journald input with supported systemd versions

5

## Proposed commit message Systemd/Journald has a [bug](https://github.com/systemd/systemd/issues/24320) that will cause Filebeat to be killed by a SIGBUS when reading from rotated logs. This bug is fixed in Systemd v255....

Flaky Test: packetbeat/route TestDefault - `panic: runtime error: index out of range [3] with length 3`

2

## Flaky Test * **Test Name:** TestDefault * **Link:** https://github.com/elastic/beats/blob/43d5dd4342a9ff56f40fafe1ba2ad7ed0a03b6c3/packetbeat/route/route_windows_test.go#L63 * **Branch:** main * **Artifact Link:** * https://buildkite.com/elastic/beats-packetbeat/builds/5123#018fa447-ca4c-4280-bfa7-f3f4db45c455/62-229 (First failure on main) * https://buildkite.com/elastic/beats-packetbeat/builds/5133#018fa5bd-59d7-407f-a0d0-1680d1f84f20/108-274 (PR) * https://buildkite.com/elastic/beats-packetbeat/builds/5134#018fa5ca-3037-46c7-9c08-a4204b2140ae/98-265 (PR) * **Notes:**...

Filestream `include_message` do not correctly track the offset of a file

1

For confirmed bugs, please report: - Version: `main` - Operating System: All When the `include_message` field is used, the offset is only updated based on the length of the message...

Replace `github.com/coreos/go-systemd/v22/sdjournal` by `journalctl`

9

## Proposed commit message `github.com/coreos/go-systemd/v22/sdjournal` is removed and Filebeat now calls `journalctl` directly to read journald entries. `sdjournal` relies on libsystemd to read journal files and the active system journal,...

Use journalctl to read Journald logs

1

We need to replace the current `github.com/coreos/go-systemd/v22/sdjournal` we use to read Journald logs by calling `journalctl` direct. The problem with `github.com/coreos/go-systemd/v22/sdjournal` is that it relies on libsystemd and it is...

## Proposed commit message This commit improves Filebeat's input lifecycle logging as well as Filestream logs. All logs related to input starting/stopping now contain the `input_id` key, with the value...

Fix system module with both filesets enabled

1

## Proposed commit message The system module did not define an ID at the root of the config, that made the V2 input loader only start the first journald input...

Read journal entries from all boots

6

## Proposed commit message Some versions of journalctl will only return messages from the current boot when --follow is passed, it will even ignore the cursor or date arguments. This...