Amazon CloudWatch agent adds support for journald logs

Amazon CloudWatch Agent Now Supports systemd Journal Logs

AWS has introduced support for collecting systemd journal (journald) logs using the Amazon CloudWatch agent. This update allows you to configure the CloudWatch agent to read log entries directly from the systemd journal on Linux instances and send them to Amazon CloudWatch Logs without writing those logs to files on disk.

Many modern Linux distributions, including Amazon Linux 2023, use systemd journal as the primary logging system and no longer write traditional text log files by default. This new feature reads journald entries natively, preserving structured metadata such as systemd unit, priority, and process information. You can filter log entries using systemd units, journal priority levels, and journal field matches, and apply regular expression filters before logs are published to CloudWatch Logs. This helps reduce noise and control log volume and costs.

Support for journald in the CloudWatch agent is available in all AWS Commercial Regions and GovCloud(US) regions. Standard Amazon CloudWatch Logs pricing applies for ingested logs.

What to do

• Update to the latest version of the CloudWatch agent.
• Add a journald section to your agent configuration file.
• Learn more in the Amazon CloudWatch User Guide.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.