[9.5](backport #52231) Fix journald input on journalctl older than 245 with facility filters

[mergify]

Proposed commit message

journalctl only supports the --facility flag since systemd v245, but the journald input passed it unconditionally whenever facilities was configured. On older systems (e.g. RHEL 8, which ships systemd 239) journalctl exits immediately with unrecognized option '--facility' and the input restarts it in an endless backoff loop, silently collecting no events. The System integration configures facility filters on both of its journald streams, so those streams collect nothing on RHEL 8.

Instead of gating the flag on the journalctl version, facilities are now always passed as SYSLOG_FACILITY=N journal field matches. Every journalctl version supports field matches, and --facility is implemented internally as exactly these matches: matches on the same field are ORed together, the same semantics as repeated --facility flags. Because journalctl does not range-check field matches the way it range-checks --facility, the input's config now validates that each facility is within 0-127 (the range --facility accepts), so an out-of-range value fails at config time instead of silently matching nothing.

While moving config validation around, the deprecation warning for the legacy 7.x include_matches array format was also moved out of Unpack (which had to use a package-global logger) into Configure, where the input's logger is available.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

On journalctl >= 245 the selected events are unchanged (only the journalctl command line differs). On older versions, configurations with facilities set go from collecting nothing (journalctl crash loop) to collecting the requested events. Configurations with a facility outside 0-127 now fail config validation; previously such values made journalctl (>= 245) exit with an error at runtime.

How to test this PR locally

On a host/container with systemd < 245 (e.g. RHEL 8 / ubi8), run Filebeat with:

filebeat.inputs:
  - type: journald
    id: test-facility
    facilities: [4, 10]

Without this patch journalctl exits with code 1 (unrecognized option '--facility') in a restart loop and no events are ingested. With the patch, Filebeat invokes journalctl with SYSLOG_FACILITY=4 SYSLOG_FACILITY=10 matches (on every journalctl version) and ingests events.

Unit tests: go test ./filebeat/input/journald/...

Related issues

• Relates GA support for reading from journald #37086
• Same class of bug as Journald input is not compatible with Journald < v242 #48152 (--boot all on journalctl < 242)
• Integration-side mitigation: [system] Replace journald facilities option with SYSLOG_FACILITY matches integrations#20303

---

This is an automatic backport of pull request #52231 done by [Mergify](https://mergify.com).

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.