Systemd and Journald have significant benefits over Syslog, our favorite of which is the ability to write structured logs.
However, once you want to centralize your logs, you start feeling some downsides, and start missing the wide support of syslog as a transport mechanism.

Therefore, to send Journald to Loom, we will simply route it to Syslog, which in turn forward it once more to Loom.

Step 1 - configuring Rsyslog

Open Loom in your browser, then go to the data sources screen and select "add a new data source".
Choose Linux, and follow the steps to configure Rsyslog to forward system events to Loom.

Step 2 - configure Journald to forward to Syslog

Open the /etc/systemd/journald.conf  file and uncomment the following line:

ForwardToSyslog=Yes

Next restart the systemd-journald service.

Step 3 - Verify that you see events in Loom

Note that it sometimes takes up to 5 minutes until you will start seeing data in Loom.
Once streaming starts, you should see a green syslog data-source in the data-sources page. Click the eye icon to see a sample of the data.

Did this answer your question?