I'm used to sending my logs from a server to a remote Logstash using rsyslog, with a configuration file roughly as follows (usually more specific to prevent too many logs from being sent):

*.* @

I'm now starting work on a server that does not have syslog running but instead uses journald. Is there a similar way to send the logs to Logstash with journald as is done with Syslog, or does it require more work? I can't find much information online regarding the use of Logstash with journald.


There is no official support, but there is an open issue to get it added. It turns out there are a few plugins that shim in this support, notably logstash-input-journald.

  • Thanks, I'll probably stick to using journald forwarding messages to rsyslog for now. This is probably still what most logstash user do to this date? – Loic Duros Feb 5 '16 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.