read-journal

Reads from the systemd journal and emits entries as events. A cursor and timestamp are stored in db so that processing resumes from where it left off.

When tail-interval is set, the plugin re-reads the journal on that interval until shutdown. Without it, the plugin reads once (backfill) then exits.

Config

Optional:

• journalctl: Path to the journalctl binary (default: journalctl)
• db: State file path (default: logbus-journal-db)
• since: Start time as Unix epoch seconds (default: now). Ignored once a cursor is stored in db.
• batch-size: Maximum journal entries per invocation (default: 1000)
• tail-interval: Seconds between re-reads (default: none — read once and exit)

Example

pipeline:
  read-journal:
    config:
      db: /var/lib/logbus/journal-state.json
      since: 1700000000
      tail-interval: 60