systemd input plugin reads logs from the systemd journal

Simply use RubyGems:

gem install fluent-plugin-systemd

or

fluent-gem install fluent-plugin-systemd

or

td-agent-gem install fluent-plugin-systemd

<source>
  type systemd
  path /var/log/journal
  filters [{ "_SYSTEMD_UNIT": "kube-proxy.service" }]
  pos_file kube-proxy.pos
  tag kube-proxy
  read_from_head true
</source>

path

Path to the systemd journal, defaults to /var/log/journal

filters

Array of filters, see here for further documentation, defaults to no filtering.

pos file

Path to pos file, stores the journald cursor. File is created if does not exist.

read_from_head

If true reads all available journal from head, otherwise starts reading from tail, ignored if pos file exists. Defaults to false.

strip_underscores

If true strips underscores from the beginning of systemds field names. May be useful if outputting to kibana, as underscore prefixed fields are unindexed there.

tag

Required the tag for events generated by this input plugin.

For an example of a full working setup including the plugin, take a look at

This plugin depends on libsystemd

To run the tests with docker on several distros simply run rake

For systems with systemd installed you can run the tests against your installed libsystemd with rake test

MIT

Issues and pull requests welcome