Open belimawr opened 1 month ago
Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)
Following the revert here: https://github.com/elastic/beats/pull/41489 Should we keep this one open?
We haven't deleted the input yet, we just reverted its usage, I'd keep it open for now, at least until we decide how we're handling journald in Filebeat's system module.
The
system-logs
input is a "proxy input" that decides whetherjournald
orlog
should be used as input for Filebeat's system module. At the moment of writing it is intended to be used only by the system integraiton.One problem with the current implementation is that the
input.type
set in the event issystem-logs
instead of the actual name of the input running/collecting the data.As a quick fix, we're overwriting
input.type
using ES ingest pipelines, however this is not ideal. This issue is about finding a way to get this fixed within Filebeat and haveinput.type
correctly set.