[system] Replace journald facilities option with SYSLOG_FACILITY matches

[nicholasberlin]

Proposed commit message

The auth and syslog journald stream templates hardcoded the facilities option, which the Filebeat journald input translates into journalctl --facility. That flag was only added in systemd 245, so on hosts with older journalctl (all RHEL 8, which ships 239) journalctl exits with unrecognized option '--facility', the reader restarts in an endless loop, and both streams silently collect zero events while reporting Healthy.

Replace facilities with equivalent SYSLOG_FACILITY=<n> entries in include_matches. journalctl implements --facility internally as SYSLOG_FACILITY matches, and matches on the same field are ORed, so the filtering is identical — but plain field matches work on all journalctl versions, and the fix reaches already-deployed 8.17+/9.x agents via a normal integration upgrade without waiting for a stack release. User-supplied include_matches expressions are appended to the same list, preserving the previous AND semantics across different fields.

Behavior note for reviewers

There is one deliberate semantic change, limited to users who put their own SYSLOG_FACILITY=<n> expressions in the stream's Include Matches setting. Previously the facility filter and user matches were ANDed by journalctl, so a user-supplied facility outside the hardcoded set produced an empty intersection — zero events, silently. Now that user entry joins the same field group as the built-in facility matches and is ORed, so it adds that facility to the stream instead. The old behavior was indistinguishable from the bug this PR fixes and could not have been used productively; the new semantics are documented in the updated include_matches variable descriptions in both data-stream manifests. Matches on any other journal field (e.g. _SYSTEMD_UNIT=...) are unaffected — they remain ANDed with the facility filter exactly as before.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

cd packages/system
elastic-package stack up -d
elastic-package test system --data-streams auth,syslog -v

All four variants pass locally (auth default/journald, syslog default/journald); the journald tests replay real .journal files through an agent and assert exact hit counts (9 auth / 3 syslog), which confirms the SYSLOG_FACILITY matches select the same events the facility filter did.

To reproduce the original failure: run the journald input on a host with journalctl < 245 (e.g. RHEL 8, systemd 239) — journalctl exits 1 with unrecognized option '--facility' and the streams collect nothing.

Related issues

• Relates GA support for reading from journald beats#37086 (comment) (the --facility incompatibility reported against the journald input; a dedicated beats issue for capability detection is being filed separately)
• Relates SDH https://github.com/elastic/sdh-beats/issues/7398

🤖 Generated with Claude Code

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/system/changelog.yml	4	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 1147f92

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)