Additional options in journald source to strip leading underscores and lowercase all key names

[krisiasty]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Use Cases

We are considering moving from fluent-bit to vector to collect local prometheus metrics and logs from systemd journal and ship them to Prometheus / OpenSearch respectively.

Like many others, we were using lowercase and strip_underscores options in fluent-bit systemd input configuration (see: https://docs.fluentbit.io/manual/data-pipeline/inputs/systemd), which simplifies key name normalization.

Although it is possible to achieve similar effect using VRL in Vector, it is not straightforward, especially for new users without much experience in VRL.

It would be great to have similar configuration options at the journald source like in fluent-bit to avoid writing not-so-easy transforms for key name normalization.

Most of the keys coming from journald source are in upper case and have leading underscore (like _UID, or _SYSTEMD_UNIT) - which is causing ElasticSearch / OpenSearch to complain (such names are reserved for metadata). There are also few keys starting with double underscore (like __REALTIME_TIMESTAMP).

Having those features implemented natively in the journald source would not only simplify configuration and switching from other solutions like fluent-bit, but probably also be more performant.

Attempted Solutions

As mentioned above, it's possible to implement similar effect using VRL, but it's not an easy task (haven't found any working examples), and may be less performant.

Proposal

Suggested approach would be to implement this in a similar way to fluent-bit, meaning to add two boolean options to journald source configuration - lowercase and strip_underscores, both defaulting to false, which would pre-process all key names coming from systemd journal.

References

No response

Version

vector 0.51.1 (x86_64-unknown-linux-gnu 44c8f1c 2025-11-13 15:16:05.303418529)

[krisiasty]

As a temporary solution, I would recommend to provide example implementation in VRL in the documentation (ideally in the journald source section and maybe also in more verbose form in Configuration Guides).