From 79c11c0348bdf9a2ec4af7cf9b35bc1aa2d48122 Mon Sep 17 00:00:00 2001
From: Andrew Bonney <andrew.bonney@bbc.co.uk>
Date: Tue, 10 May 2022 13:15:33 +0100
Subject: [PATCH] Add journald input support to filebeat

Journalbeat is removed in ELK 7.16 and merged into
filebeat. This patch adds defaults which allow this
input to be enabled via a single variable.

Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-ops/+/843423
Change-Id: I5563d6493a6a53374170c4bdaa1edfbff85b300d
---
 elk_metrics_7x/roles/elastic_filebeat/defaults/main.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/elk_metrics_7x/roles/elastic_filebeat/defaults/main.yml b/elk_metrics_7x/roles/elastic_filebeat/defaults/main.yml
index 1427dac5..a28cb810 100644
--- a/elk_metrics_7x/roles/elastic_filebeat/defaults/main.yml
+++ b/elk_metrics_7x/roles/elastic_filebeat/defaults/main.yml
@@ -282,6 +282,13 @@ filebeat_prospectors:
       - /var/log/elasticsearch/*.log
     tags:
       - beats
+  # Journald supported from filebeat >= 7.16.0
+  - type: journald
+    enabled: "{{ filebeat_journald_enabled | default(false) }}"
+    paths:
+      - /var/log/journal
+    tags:
+      - journal
 
 filebeat_ilm_policy_name: "filebeat-{{ beat_version }}"
 filebeat_ilm_policy_template: "filebeat-{{ beat_version }}"