Add support for Journald input

[mindriot88]

The initial purpose of this change was to add support for the journald input which was introduced in 7.16, however I personally don't think it makes sense to split out the input template for version 6 config and filestream config when the configuration syntax is so nearly identical, the separate template for version 5 is reasonable.

I have also taken the liberty of correcting some of versioning constraints put in around the usage of the filestream input, as it was actually added in 7.10 but this module restricted its use to version 7.16+, this has been mentioned in #299

I have also added support for global configuration keep_null and index as described in #287

I will do my best to address any feedback in a timely manor.

[pcfens]

This looks awesome and is a huge help.

Could you do 2 things that will help with the merge? The first is just updating the README to reflect the new input parameters so the docs stay up to date. To make merging easier can you rebase as well? I suspect that's from your fork pre-dating some other recent change made in this copy.

Thanks again!

[mindriot88]

This looks awesome and is a huge help.

Could you do 2 things that will help with the merge? The first is just updating the README to reflect the new input parameters so the docs stay up to date. To make merging easier can you rebase as well? I suspect that's from your fork pre-dating some other recent change made in this copy.

Thanks again!

No problem, ill do that.

In terms of my approach to resolving the conflicts, this what I suggest:

• changes in This commit adds syslog support to configuration #301 should be thrown away, as the pre filestream template already had syslog support
• I will throw away all changes in allow filebeat major_version 8 to be used #300 expect for the change to the version emun to allow for 8 as a valid input and change major version 8 to the default from 7.

Does this sound reasonable?

If I have time I can look at throwing in a test to validate the correct template is used for the various versions supported.

[mindriot88]

@pcfens Apologies for delay, the merge conflicts are resolved.