在Filebeat中有一个journald input，因此您不需要单独部署Journaldbeat（已弃用）。
journald本身支持日志中的结构化数据（您可以运行journalctl -o json来查看日志中的字段）。因此，如果journald日志驱动程序将容器元数据传递给journald，那么Filebeat产生的事件将包含像container.{id,name,image.tag}这样的字段（假设它遵循与Docker journald log driver相同的字段命名）。或者，如果它使用自定义命名约定，则Filebeat将生成具有journald.custom.*等字段的事件。
下面是运行journalctl -o json | jq -S .时podman日志在我的机器上的样子

{
  "CODE_FILE": "src/ctr_logging.c",
  "CODE_FUNC": "write_journald",
  "CODE_LINE": "264",
  "CONTAINER_ID": "ee059a097566",
  "CONTAINER_ID_FULL": "ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac",
  "CONTAINER_NAME": "modest_heyrovsky",
  "CONTAINER_PARTIAL_MESSAGE": "true",
  "MESSAGE": "10.0.2.100 - - [29/Aug/2023:16:46:50 +0000] \"GET / HTTP/1.1\" 200 45",
  "PRIORITY": "6",
  "SYSLOG_IDENTIFIER": "conmon",
  "_AUDIT_LOGINUID": "1000",
  "_AUDIT_SESSION": "4",
  "_BOOT_ID": "f5f4c28d95df4cfaaac4d7ec5e33eeb5",
  "_CAP_EFFECTIVE": "1ffffffffff",
  "_CMDLINE": "/usr/bin/conmon --api-version 1 -c ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac -u ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac -r /usr/bin/crun -b /home/ubuntu/.local/share/containers/storage/overlay-containers/ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac/userdata -p /run/user/1000/containers/overlay-containers/ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac/userdata/pidfile -n modest_heyrovsky --exit-dir /run/user/1000/libpod/tmp/exits --full-attach -s -l journald --log-level warning --runtime-arg --log-format=json --runtime-arg --log --runtime-arg=/run/user/1000/containers/overlay-containers/ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac/userdata/oci-log -t --conmon-pidfile /run/user/1000/containers/overlay-containers/ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac/userdata/conmon.pid --exit-command /usr/bin/podman --exit-command-arg --root --exit-command-arg /home/ubuntu/.local/share/containers/storage --exit-command-arg --runroot --exit-command-arg /run/user/1000/containers --exit-command-arg --log-level --exit-command-arg warning --exit-command-arg --cgroup-manager --exit-command-arg systemd --exit-command-arg --tmpdir --exit-command-arg /run/user/1000/libpod/tmp --exit-command-arg --runtime --exit-command-arg crun --exit-command-arg --storage-driver --exit-command-arg overlay --exit-command-arg --events-backend --exit-command-arg journald --exit-command-arg container --exit-command-arg cleanup --exit-command-arg ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac",
  "_COMM": "conmon",
  "_EXE": "/usr/bin/conmon",
  "_GID": "1000",
  "_HOSTNAME": "linux",
  "_MACHINE_ID": "0829fb9723294fceb0eddbf4c45b197b",
  "_PID": "6088",
  "_SELINUX_CONTEXT": "unconfined\n",
  "_SOURCE_REALTIME_TIMESTAMP": "1693327610600063",
  "_SYSTEMD_CGROUP": "/user.slice/user-1000.slice/[email protected]/user.slice/libpod-conmon-ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac.scope",
  "_SYSTEMD_INVOCATION_ID": "98a1d7a85cf048eaa726b6e5aadbb043",
  "_SYSTEMD_OWNER_UID": "1000",
  "_SYSTEMD_SLICE": "user-1000.slice",
  "_SYSTEMD_UNIT": "[email protected]",
  "_SYSTEMD_USER_SLICE": "user.slice",
  "_SYSTEMD_USER_UNIT": "libpod-conmon-ee059a097566fdc5ac9141bfcdfbed0c972163da891de076e0849d7b53597aac.scope",
  "_TRANSPORT": "journal",
  "_UID": "1000",
  "__CURSOR": "s=66bb92cf8741499ca3d9dd4ef84dd0a4;i=2427;b=f5f4c28d95df4cfaaac4d7ec5e33eeb5;m=18f10791ee;t=604128eb7daa0;x=41277d78955a13c3",
  "__MONOTONIC_TIMESTAMP": "107123020270",
  "__REALTIME_TIMESTAMP": "1693327610600096"
}

此外，在使用Filebeat日志输入时，您可能希望应用一个过滤器，以便仅从podman摄取数据。这将产生与journalctl _COMM=conmon相同的数据。

filebeat.inputs:
- type: journald
  id: podman-container-logs
  include_matches.match:
    - _COMM=conmon