Document Journald on docker

[belimawr]

Proposed commit message

Document the requirements to read from Journald when using Elastic-Agent in Docker for the following integrations:

• Custom Journald logs
• System
• Iptables Logs

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

## Author's Checklist

How to test this PR locally

• Build the integration
• Check the docs

Related issues

• Closes Document the Journald input requires the elastic-agent-complete docker image and the journalctl version constraint. #13019

## Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[rdner]

I wonder what would it cost us (in terms of the image size) to include journalctl in our regular Ubuntu/Ubi/Wolfi images?

Did we look into it?

I think it's not the best user experience if ask to use the complete image for such a common use-case.

[belimawr]

I wonder what would it cost us (in terms of the image size) to include journalctl in our regular Ubuntu/Ubi/Wolfi images?

Did we look into it?

I think it's not the best user experience if ask to use the complete image for such a common use-case.

I don't think we (data-plane) looked into it. IIRC when the change to use journalctl was merged in Beats, some tests on this repo broke and the decision at the time was to use the complete image, there is a little bit of context here: #10998. I didn't question it at the time, however now this use case seems to be growing.

I did a quick test by just installing the systemd package in our 9.0.0 wolfi image and it only adds about 170Mb:

Dockerfile

FROM docker.elastic.co/elastic-agent/elastic-agent-wolfi:9.0.0
USER root
RUN apk update
RUN apk add systemd
ENTRYPOINT ["/usr/bin/journalctl", "--version"]

elastic-agent-wolfi-journald                          latest           f91135ef22b0   4 minutes ago   1.84GB
docker.elastic.co/elastic-agent/elastic-agent-wolfi   9.0.0            2aad676542e0   13 days ago     1.67GB

I like the idea of adding journalctl to the wolfi images, specially because wolfi repositories contain the latest systemd, which is a huge advantage compared with the current complete image that ships an older version of journalctl.

I'd merge this PR as it is, because it documents the current state and how to use the journald input with Elastic-Agent, allowing users to already benefit from it.

Once we have a new release of Elastic-Agent with journalctl in a smaller image, we can update the docs, likely keeping version statements, so users know which image variants in which versions contain journalclt.

[rdner]

So, the size increase for Wolfi is only about 10%. I'm fine with merging this PR as it is but it should be addressed by extending all of our Docker images and having journalctl there.

[belimawr]

So, the size increase for Wolfi is only about 10%. I'm fine with merging this PR as it is but it should be addressed by extending all of our Docker images and having journalctl there.

I'm already working on it, you can follow this issue: elastic/beats#44040. The Beats PR is up, I'll work on Elastic-Agent soon.

[shmsr]

Approving but I have requested a couple of changes.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: b4e4c43

Failed CI Steps

• Check integrations journald

History

• 💚 Build #24891 succeeded e16a3ac
• 💔 Build #24881 failed eb5332a

cc @belimawr

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[rdner]

@belimawr Do we still need to merge this since we about to solve it with elastic/elastic-agent#7995 ?

[cmacknz]

So, the size increase for Wolfi is only about 10%. I'm fine with merging this PR as it is but it should be addressed by extending all of our Docker images and having journalctl there.

Increasing the size of the elastic-agent container by 170 MB is a definite no-go right now. We are trying to slowly bring that container size down to something that isn't ludicrous and adding on 170 MB goes against that. PM would need to be OK with that size increase and I don't think they will be.