Support for path globbing

[ghost]

Describe the enhancement:
Journalbeat has no way to use globbing for paths in journalbeat.inputs. There are some cases where multiple journals in different subdirectories exist.

Describe a specific use case for the enhancement or feature:
OpenStack-Ansible uses containers and links the journals to /openstack/log/. This leads to several different subdirectories with different names:

drwxr-xr-x  5 root   root  x-aodh_container-1a/
drwxr-xr-x  4 root   root  x-ceilometer_central_container-a7/
drwxr-xr-x  7 root   root  x-ceph-mon_container-c7/
drwxr-xr-x  4 root   root  x-cinder_api_container-2c/
(…)

Journalbeat should be able to access them like this:

- paths:
  - "/var/log/journal"
  - "/openstack/log/*/journal/*/system.journal"

But this is not possible right now:

ERROR	instance/beat.go:951	Exiting: error creating reader for journal: reader.go:107: failed to read meta data for /openstack/log/*/journal/*/system.journal (path=/openstack/log/*/journal/*/system.journal)
	stat /openstack/log/*/journal/*/system.journal: no such file or directory

[elasticmachine]

Pinging @elastic/integrations-services (Team:Services)

[jocelynthode]

@kbojens Hey we are facing the same issue. Did you find a workaround in the meantime?

[jlind23]

Hello @kbojens

As of 7.16 journald is provided as an input to Filebeat: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-journald.html. Consequently journalbeat has been deprecated from that release onwards.

cc @kvch

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[kvch]

Unfortunately, it is not supported in journald input either.

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[RomeoOscarPapaAlpha]

We are facing the same issue. Are there any updates or workarounds? Thx

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!