How to get everything from journal?

System works fine with unit filters, but how to get everything from journal , e.g as plain journalctl would return?

tried with empty filters [], assuming that _TRANSPORT would always return something and thus not block jq transformer changing the record.source. <source> @id journald-all @type systemd @label @SPLUNK tag journald.all:all path "/run/log/journal" filters [] read_from_head true <storage> @type local persistent true </storage> <entry> field_map {"MESSAGE": "log", "_TRANSPORT": "source"} field_map_strict true </entry> </source>

fluentd log looks perfectly fine, conf is read ok, but nothing from systemd comes out to Splunk ( all other source types do continue working) . If i switch back to systemd <source>s with unit filters, starts working.

Any help is appreciated…

Thanks in advance, Jan

[sayeedc]

This should work `<source> @id journald-all @type systemd @label @SPLUNK tag journald.journal:all path “/run/log/journal” matches [] read_from_head true <storage> @type local persistent true </storage> <entry> field_map {“MESSAGE”: “log”, “_SYSTEMD_UNIT”: “source”} field_map_strict true </entry>

</source>`

[chaitanyaphalak]

Closing the issue as @sayeedc has got it working.