systemd journald

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/journald"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/ebaaf79f-32c5-4a51-8b19-d7dda3b8fc69/social-card.svg?v=3e7ae33eec8b" alt="systemd journald" width="600" height="315"></a>

Read the journal with your own OpenTelemetry Collector (contrib) running on the host. The receiver shells out to journalctl, so it must be on the PATH and the collector user must be able to read the journal (group systemd-journal). Needs an ingestion key with ingest:logs; set WT_OTLP_ENDPOINT and WT_INGEST_KEY.

receivers:
  journald:
    directory: /var/log/journal
    units: [ssh, nginx]
    priority: info
processors:
  batch: {}
exporters:
  otlphttp:
    endpoint: ${env:WT_OTLP_ENDPOINT}
    headers:
      Authorization: "Bearer ${env:WT_INGEST_KEY}"
service:
  pipelines:
    logs:
      receivers: [journald]
      processors: [batch]
      exporters: [otlphttp]

Omit units to read everything. Journal fields arrive as log attributes.

Updated