Update README.md
Costa Tsaousis committed
Oct 7, 2023 at 13:32 UTC
a7c1e6bd2b235c2e962ecc0e8a4c76210a997fe6
1 file changed
+19
collectors/systemd-journal.plugin/README.md
+19
@@ -263,6 +263,25 @@ disk I/O, or does not have any writable disks at all.
263
264
For more information check `man systemd-journald`.
265
266
+### I centralize my logs with Loki. Why to use Netdata for my journals?
267
+
268
+`systemd` journals have almost infinite cardinality at their labels and all of them are indexed,
269
+even if every single message has unique fields and values.
270
+
271
+When you send `systemd` journal logs to Loki, even if you use the `relabel_rules` argument to
272
+`loki.source.journal` with a JSON format, you need to specify which of the fields from journald
273
+you want inherited by Loki. This means you loose all the flexibility `systemd` journal provides:
274
+**indexing on all fields and all their values**.
275
+
276
+Loki generally assumes that all logs are like a table. All entries in a stream share the same
277
+fields. But journald does exactly the opposite. Each log entry is unique and may have its own unique fields.
278
+
279
+So, Loki and `systemd-journal` are good for different use cases.
280
+
281
+`systemd-journal` already runs in your systems. You use it today. It is there inside all your systems
282
+collecting the system and applications logs. And for its use case, it has advantages over other
283
+centralization solutions. So, why not use it?
284
+
285
### Is it worth to build a `systemd` logs centralization server?
286
287
Yes. It is simple, fast and the software to do it is already in your systems.