[system] Replace journald facilities option with SYSLOG_FACILITY matches

packages/system/changelog.yml

@@ -1,4 +1,9 @@
 # later versions go on top
+- version: "2.21.1"
+  changes:
+    - description: Replace the journald `facilities` option with equivalent `SYSLOG_FACILITY` matches in the auth and syslog streams, fixing silent collection failure on hosts with journalctl older than 245 (e.g. RHEL 8), where `journalctl --facility` is not supported.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20303
 - version: "2.21.0"
   changes:
     - description: Parse Windows Security scheduled task XML and task names into structured winlog.scheduled_task.* fields for detection and hunting.

packages/system/data_stream/auth/agent/stream/journald.yml.hbs

@@ -4,9 +4,16 @@ type: journald
 # /var/log/auth.log*, /var/log/secure*
 # This is the equivalent to the filter used by rsyslog:
 # auth,authpriv.*                 /var/log/auth.log
-facilities:
-  - 4
-  - 10
+# SYSLOG_FACILITY field matches are used instead of the `facilities`
+# option because the latter relies on `journalctl --facility`, which
+# requires systemd >= 245 (RHEL 8 ships 239). journalctl ORs matches
+# on the same field, so this is equivalent to the facility filter.
+include_matches:
+  - SYSLOG_FACILITY=4
+  - SYSLOG_FACILITY=10
+{{#each include_matches as |include_match i|}}
+  - '{{include_match}}'
+{{/each}}
 
 {{#if condition }}
 condition: {{condition}}
@@ -19,13 +26,6 @@ paths:
 {{/each}}
 {{/if}}
 
-{{#if include_matches}}
-include_matches:
-{{#each include_matches as |include_match i|}}
-  - '{{include_match}}'
-{{/each}}
-{{/if}}
-
 tags:
 {{#if preserve_original_event}}
   - preserve_original_event

packages/system/data_stream/auth/manifest.yml

@@ -78,8 +78,8 @@ streams:
         show_user: false
         description: >
           A list of filter expressions used to select the logs to read (e.g. `_SYSTEMD_UNIT=vault.service`). Defaults to all logs. See [include_matches](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-journald.html#filebeat-input-journald-include-matches) for details.
-          The logs are already filtered by the following syslog facilities: 4, 10, so any filter added here will be added to this existing
-          filter.
+          The logs are already filtered by syslog facilities 4 and 10 via `SYSLOG_FACILITY` matches. Expressions added here are appended
+          to that filter: matches on the same journal field are ORed, matches on different fields are ANDed (journalctl semantics).
 
       - name: processors
         type: yaml

packages/system/data_stream/syslog/agent/stream/journald.yml.hbs

@@ -2,19 +2,26 @@ type: journald
 
 # Filter by syslog facilities, replicating the traditional log files
 # /var/log/syslog*, /var/log/messages*
-facilities:
-  - 0
-  - 1
-  - 2
-  - 3
-  - 5
-  - 6
-  - 7
-  - 8
-  - 9
-  - 11
-  - 12
-  - 15
+# SYSLOG_FACILITY field matches are used instead of the `facilities`
+# option because the latter relies on `journalctl --facility`, which
+# requires systemd >= 245 (RHEL 8 ships 239). journalctl ORs matches
+# on the same field, so this is equivalent to the facility filter.
+include_matches:
+  - SYSLOG_FACILITY=0
+  - SYSLOG_FACILITY=1
+  - SYSLOG_FACILITY=2
+  - SYSLOG_FACILITY=3
+  - SYSLOG_FACILITY=5
+  - SYSLOG_FACILITY=6
+  - SYSLOG_FACILITY=7
+  - SYSLOG_FACILITY=8
+  - SYSLOG_FACILITY=9
+  - SYSLOG_FACILITY=11
+  - SYSLOG_FACILITY=12
+  - SYSLOG_FACILITY=15
+{{#each include_matches as |include_match i|}}
+  - '{{include_match}}'
+{{/each}}
 
 {{#if condition }}
 condition: {{condition}}
@@ -27,13 +34,6 @@ paths:
 {{/each}}
 {{/if}}
 
-{{#if include_matches}}
-include_matches:
-{{#each include_matches as |include_match i|}}
-  - '{{include_match}}'
-{{/each}}
-{{/if}}
-
 tags:
 {{#if preserve_original_event}}
   - preserve_original_event

packages/system/data_stream/syslog/manifest.yml

@@ -86,8 +86,8 @@ streams:
         description: >
           A list of filter expressions used to select the logs to read (e.g. `_SYSTEMD_UNIT=vault.service`). Defaults to all logs. See
           [include_matches](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-journald.html#filebeat-input-journald-include-matches) for details.
-          The logs are already filtered by the following syslog facilities: 0, 1, 2, 3, 5, 6, 7, 8, 9, 11, 12, 15, so any filter added here will be added to this existing
-          filter.
+          The logs are already filtered by syslog facilities 0, 1, 2, 3, 5, 6, 7, 8, 9, 11, 12 and 15 via `SYSLOG_FACILITY` matches. Expressions added here are appended
+          to that filter: matches on the same journal field are ORed, matches on different fields are ANDed (journalctl semantics).
 
       - name: processors
         type: yaml

packages/system/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: system
 title: System
-version: "2.21.0"
+version: "2.21.1"
 description: Collect system logs and metrics from your servers with Elastic Agent.
 type: integration
 categories: