[Journald] Add `Ignore older than` setting

[jamiehynds]

The new 'Custom Journald' integration does not include the 'ignore older than' setting, which other integrations include (e.g. System). Can we add the 'Ignore older than' setting under advanced options to the Journald integration?

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

I think the best way to implement this would be to enhance the journald input to expose the ability to use time filtering. Then we can pass through a relative time filter like --since=now-{{ignore_older}} under the assumption that filtering at the source is a lot more efficient that trying to filter after reading and parsing the data.

• See the --since option. https://www.freedesktop.org/software/systemd/man/journalctl.html#

[efd6]

I have a sketch for the change to the input, but I'm not particularly happy with it. It's based around using an open with parameter and it requires that the seek option be ignored if the since option is set.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[andrewkroh]

The feature has been available in Filebeat since 8.10. See

https://www.elastic.co/guide/en/beats/filebeat/8.10/filebeat-input-journald.html#filebeat-input-journald-since

seek: cursor
cursor_seek_fallback: since
since: -24h

The input package around it needs updated to expose the setting.