Journal Source

Example
yaml
sources:
   journal:
    type: journald  
    sink: my_humio  
    directory: /var/log/journal
    includeUnits:
     - systemd-modules-load.service
    excludeUnits:
     - systemd-modules-load.service
    currentBootOnly: false
sinks:
 my_humio:
  type: humio
  token: $INGEST_TOKEN
  url: https://cloud.us.humio.com
  compression: gzip
  compressionLevel: 9
  tls:
   insecure: false
   caFile: /etc/ssl/cert.pem
  proxy: none
queue:
 fullAction: deleteOldest
 memory:
  flushTimeOutInMillisecond: 200
  maxLimitInMB: 1024
Introduction

This configuration collects JournalD logs on Linux system, allowing fine-grained filtering by units, directories, or boot session.

Step-by-Step
  1. yaml
    sources:
   journal:
    type: journald  
    sink: my_humio  
    directory: /var/log/journal
    includeUnits:
     - systemd-modules-load.service
    excludeUnits:
     - systemd-modules-load.service
    currentBootOnly: false

    This fragment defines a Journald source that reads logs from the local journal with unit-level filtering and boot session control.

  2. yaml
    sinks:
 my_humio:
  type: humio
  token: $INGEST_TOKEN
  url: https://cloud.us.humio.com
  compression: gzip
  compressionLevel: 9
  tls:
   insecure: false
   caFile: /etc/ssl/cert.pem
  proxy: none

    This fragment defines a secure Humio sink with TLS configuration, token-based authentication, and gzip compression.

  3. yaml
    queue:
 fullAction: deleteOldest
 memory:
  flushTimeOutInMillisecond: 200
  maxLimitInMB: 1024

    This fragment configures an in-memory event queue for buffering journald logs, with auto-deletion behaviour when full.

  4. Event Result set.

Summary and Results

This example collects logs from journald, filters specific systemd units, and sends them securely to a Humio sink using compression and TLS.