Add support for "current boot" logic for journald source

[bruceg]

The journald source has an option for limiting reading from the volatile ("runtime") journal which defaults to true. While these logs are by definition lost at each reboot, most non-embedded systems don't actually use the volatile journal, resulting in "empty" journals with the default options. The persistent journal also has boot markers that allow for limiting journal retrieval to only records since the current boot.

Vector could add support for limiting journald retrieval to the current boot logs, either as an additional option or to replace the current runtime option.

[binarylogic]

Vector could add support for limiting journald retrieval to the current boot logs, either as an additional option or to replace the current runtime option.

👍 it makes sense to change the default to this. A couple of questions:

1. I assume journald source fails to retrieve checkpoint #1081 would have been prevented if this was the default?
2. This option is mutually exclusive with current_runtime_only, correct? If so, would it make more sense to add a read_since option that would be an enum of current_runtime, current_boot, all?

[bruceg]

1. journald source fails to retrieve checkpoint #1081 would have been prevented if this was the default, though it did uncover a bug as well when there are no logs present.
2. It is not strictly mutually exclusive, no, but the "runtime only" flag implies "current boot" since the runtime journal is volatile. Handling it as an enum makes sense, though I think the name read_since may be a bit confusing. Is there any call for only looking at the runtime volatile journal? Not even the journalctl command has this option.

[binarylogic]

Sounds good.

Is there any call for only looking at the runtime volatile journal?

What exactly do you mean here? I'll defer to you on what's best. Obviously I want to resolve the current issue, which appears to be the case if we change the default to read from the current boot, correct?

[bruceg]

What exactly do you mean here? I'll defer to you on what's best. Obviously I want to resolve the current issue, which appears to be the case if we change the default to read from the current boot, correct?

The systemd journal library can be told to read from only the volatile runtime journal, or from all the journals. There doesn't appear to be much support for limiting reading to only the runtime journal, notably including no option for such in journalctl. So I ask if that option is even useful.

This is distinct from starting reading at the current boot start, which would have solved #1081 (when combined with the above).

I will proceed in this direction.