Add option "units" to monitor only specified systemd units

[Mousius]

Fixes #3 by providing an option matching the journalctl -u $SERVICE with a config option unit: $SERVICE.

[nrvnrvn]

Hi!
Two questions:

1. What if I want to filter more than one unit? journalctl -u $1 -u $2
2. Why not use filters (processors since alpha5):

filters:
  - drop_event:
      when:
        not:
          equals:
            journal.systemd_unit: ${DESIRED_SERVICE}

See more https://www.elastic.co/guide/en/beats/filebeat/master/configuration-processors.html

[Mousius]

I was unaware of filters, I'll take a look and if they work we'll start using the main journalbeat branch as well as replying to #3

[mheese]

@DaMouse404 I like this. The main reason why I haven't included the Matches yet is because I haven't tested it before. I also think - like @nicorevin said already - though that this needs to be configurable as an array, then we could merge this.

Also, what about support for filtering other things than units? systemd has support for this out-of-the-box, as should have our settings then.

@nicorevin even though the filters should work, I think we should still consider adding the possibility to configure the reader in the input. The difference is that the journal reader won't receive all messages and that can drastically reduce system load - especially on system's with a high log volume. What do you think?

Additionally, it rises again my concerns that we are using my fork of go-systemd instead of the main CoreOS branch. It was necessary at the time as the changes were necessary to get all features that we want. We should review this again, and if necessary, do a PR against the main branch.

[nrvnrvn]

@mheese yeah I was planning to review the `go-systemd`-relevant code, but've been short of time lately along with updating to [email protected] As for early filtering I think it is a good idea and it makes sense actually!

[mheese]

@DaMouse404 did you work on any updates as discussed above? I kind of would like to get this functionality in.

[Mousius]

@mheese - apologies for the delay. I updated it to create a set of matchers if you pass units as an array. I'm unsure which other journald filters will be useful so holding off on doing them all just for the sake of it. Tested it briefly by logging one of our services plus sshd.service and looks like it selects the right things and also defaults back to no matchers when I specify nothing.

[mheese]

@DaMouse404 thanks, I'll have time the 2nd half next week to work on journalbeat. I'll take the time to merge this as well. Thanks again for the contribution.

[Mousius]

@mheese - any update? 😸

[mheese]

Clean and straight forward code. It also works for me after some quick testing.

[mheese]

@nicorevin if you could also quickly review and test this, then I feel comfortable to merge it.