# read-journal

Reads from the systemd journal and emits entries as events.  A cursor and timestamp are stored in `db` so that processing resumes from where it left off.

When `tail-interval` is set, the plugin re-reads the journal on that interval until shutdown.  Without it, the plugin reads once (backfill) then exits.

## Config

**Optional:**
- `journalctl`: Path to the journalctl binary (default: `journalctl`)
- `db`: State file path (default: `logbus-journal-db`)
- `since`: Start time as Unix epoch seconds (default: now).  Ignored once a cursor is stored in `db`.
- `batch-size`: Maximum journal entries per invocation (default: `1000`)
- `tail-interval`: Seconds between re-reads (default: none — read once and exit)

## Example

```yaml
pipeline:
  read-journal:
    config:
      db: /var/lib/logbus/journal-state.json
      since: 1700000000
      tail-interval: 60
```