# read-journal

Tail the systemd journal and emit JournalLogEvents. When connected to a scheduler, will continue to tail. Otherwise, will exit once there are no more journal entries to read. A cursor & timestamp is stored in db so that processing can continue from where last left off. When there is no db, will start reading from since().

# Config

Optional:

journalctl: Path to journalctl binary (default: journalctl)
db: State file path (default: logbus-journal-db)
since: Function to return the time to start reading from (default: now)

# Example

pipeline:
  read-journal:
    config:
      since: !!js/function >-
        function() {
          return this.moment.utc().subtract(2, 'day')
        }
      db: state.json