Only start Journald input with supported systemd versions

[belimawr]

Proposed commit message

Systemd/Journald has a bug that will cause Filebeat to be killed by a SIGBUS when reading from rotated logs. This bug is fixed in Systemd v255.

This commit checks the Systemd version when a Journald input is instantiated, if it is not supported, then then the input creation fails. A warning was added to the documentation stating the minimal version of Systemd.

A Ubuntu 2204 Vagrant Box is added for testing.

Checklist

• [x] My code follows the style guidelines of this project
• [x] I have commented my code, particularly in hard-to-understand areas
• [x] I have made corresponding changes to the documentation
• [ ] ~~I have made corresponding change to the default configuration files~~
• [x] I have added tests that prove my fix is effective or that my feature works
• [x] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Filebeat will refuse to start if a Journald input is configured and the host is running an unsupported version of Journald.

There should be no disruptions for the current users because the Journald input is still in technical preview.

Author's Checklist

• [x] We can test the Journald input on CI
• [x] Any problems with adding the fork system call?
• [x] Do we want to use D-Bus?

How to test this PR locally

1. Start two VMs: Ubuntu 2204 and Archlinux

   vagrant up ubuntu2204
   vagrant up arch
   

2. SSH into the Archlinux VM and update the system to get the fixed version of Systemd and install other dependencies

   sudo pacman -Sy archlinux-keyring --noconfirm
   sudo pacman -Syu  --noconfirm
   sudo pacman -Sy base-devel --noconfirm
   sudo reboot
   # ssh into the VM again, install Go
   cd /tmp
   curl -L https://go.dev/dl/go`cat /vagrant/.go-version`.linux-amd64.tar.gz -o go.tar.gz
   sudo tar -C /usr/local -xzf ./go.tar.gz
   export PATH=$PATH:/usr/local/go/bin
   

3. Run the tests

    cd /vagrant
    go test -tags=withjournald,cgo,linux ./filebeat/input/journald/
   

4. Build Filebeat with Journald support (you can do this from within the VM):

   cd /vagrant/filebeat
   go build -tags="cgo,linux,withjournald" .
   

5. Run Filebeat in each VM: ./filebeat -e -v using the following filebeat.yml

   filebeat.yml

   filebeat.inputs:
     - type: journald
       id: journald-input
   
   output.file:
     path: ${path.home}
     filename: output
     codec.json:
       pretty: true
   

6. Assert that:

   • Filebeat starts and runs successfully in the Archlinux VM
   • Filebeat fails to start in the Ubuntu 2204 VM with the following error message:

     {"log.level":"error","@timestamp":"2024-05-16T19:28:17.850Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1345},"message":"Exiting: Failed to start crawler: starting input failed: error while initializing input: systemd version must be >= 255. Systemd version: 249","service.name":"filebeat","ecs.version":"1.6.0"}
     Exiting: Failed to start crawler: starting input failed: error while initializing input: systemd version must be >= 255. Systemd version: 249
     

Related issues

• Closes https://github.com/elastic/beats/issues/34077

~~## Use cases~~ ~~## Screenshots~~

Logs

Filebeat will fail to start with:

{"log.level":"error","@timestamp":"2024-05-16T19:28:17.850Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1345},"message":"Exiting: Failed to start crawler: starting input failed: error while initializing input: systemd version must be >= 255. Systemd version: 249","service.name":"filebeat","ecs.version":"1.6.0"}
Exiting: Failed to start crawler: starting input failed: error while initializing input: systemd version must be >= 255. Systemd version: 249