Snippets · Sources

Read systemd journal logs (journald)

On systemd hosts many services log only to the journal; there is no file to tail. The journald receiver follows the journal through journalctl and turns each entry into a log record, filtered by unit and priority.

OpenTelemetry Collector

OpenTelemetry Collector YAML

receivers:
  journald:
    directory: /var/log/journal
    units: [ssh, nginx]
    priority: info

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  batch:
    timeout: 5s

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  pipelines:
    logs:
      receivers: [journald]
      processors: [memory_limiter, batch]
      exporters: [otlphttp]

LinkMesh

Library › Sources › Journald

Systemd Units: ["ssh","nginx"]
Journal Directory: /var/log/journal
Minimum Priority: info

What LinkMesh then pushes to the collector, under receivers:

Pushed to the collector

journald/input_src_00000501:
  directory: /var/log/journal
  priority: info
  units:
    - ssh
    - nginx

The same, as an API call (see automation recipes):

API call

curl -X POST "$LINKMESH/sources" \
  -H "Authorization: Bearer $LMSAT" \
  -H "Content-Type: application/json" \
  -d '{
  "defaultConfig": {
    "directory": "/var/log/journal",
    "priority": "info",
    "units": [
      "ssh",
      "nginx"
    ]
  },
  "name": "Journald",
  "receiverType": "journald"
}'

The rest of the collector config above (memory_limiter, batch, otlphttp) is not part of this template: in LinkMesh those are separate sources, processors and destinations on the route.

Generated from LinkMesh's template catalogue by linkmesh-server snippet-render 1.464.3, not written by hand.

Download config.yamlValidated with otelcol-contrib v0.161.0 on 2026-10-26

Complete config files, each checked with the collector's own validate command (otelcol-contrib v0.161.0). Replace https://your-backend:4318 with your own OTLP endpoint before you run it.

The gotcha

The receiver runs journalctl, and the official otelcol-contrib container does not contain it. In our test the whole collector exited at start with "journalctl command failed: start journalctl: exec: \"journalctl\": executable file not found in $PATH" - not just this receiver. Run the collector from the host package, or in an image that ships journalctl, with /var/log/journal (or /run/log/journal) mounted.

Manage this across a fleet

LinkMesh manages collector configuration across a fleet from one self-hosted control plane, so a change like this is made once rather than host by host. The first 25 Collectors are free after a no-card registration in the OpenSight Customer Portal (5 without one).

Doing this in LinkMesh: Sources

Install LinkMesh →See all snippets

Read systemd journal logs (journald)

OpenTelemetry Collector

LinkMesh

The gotcha

Manage this across a fleet

Related snippets