[1oooqooq]

I'm actually considering linux+k8s log/audit solution consulting or a saas (there still isn't minimally decent journald log collectors) but not sure who would even pay for it... as you can see for the low attention this will get

[Baarsgaard]

I would recommend you try Vector. They have a Source specifically for JournalD with a good amount of customisation: https://vector.dev/docs/reference/configuration/sources/jour...

[VTimofeenko]

Seconding the vector recommendation. My (admittedly, homelab) infra log shipping is done completely through vector into redpanda. Vector even has a simple remapping language [1] that I use to enrich the data in line with the collection

[1]: https://vector.dev/docs/reference/vrl/

[linuxdude314]

Vector is GOATed, also reccomend.

[mrweasel]

Vector is both amazing and terrible. The configuration language is just awful to work with, but the functionality is amazing and I don't know what I'd replace Vector with.

If you do a lot with logs, have different sources and destination it just must have tool.