journald to Seq

[Iruwen]

I have a few systems from which which I need to relay journald logs to Seq.

One obvious approach would be journald > ForwardToSyslog > rsyslog > seq-input-syslog, but that seems kind of complex and introduces additional moving parts (possibly blocking, although that shouldn't be an issue when using udp I guess).

I just found https://github.com/systemd/journal2gelf which seems straightforward, should never block and I can just run it in another container, that seems like a good way to do it.

Or am I missing any downside with that solution?

[mloskot]

You may find this whole thread interesting too

• Ingesting logs from journalctl as json, and parsing timestamps seqcli#251

[nblumhardt]

One more for completeness, though I haven't tried it myself: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/journaldreceiver

Seq accepts OpenTelemetry-formatted data natively, so journald → OpenTelemetry Collector → Seq would mean no need for any server-side plug-ins. HTH!

[Iruwen]

Thank you - adding another one myself I found while looking for a solution to the issues mentioned here: Vector's journald source with the added advantage of checkpointing so it resumes where it left off if restarted.