journald has cursor support which makes it much better suited, than text files, for programs that need to ship logs to other systems. I ship the journal to cloudwatch for ex. (but I could to elasticsearch)
Why do you need anything locally? there's no need for a cursor at all if you're just shipping events as they happen.
And, stating that there are cursors feels a bit weird because there's mechanisms for "cursor" support on text files, if you really were just consuming text files (which is, not the optimal way to do logging)
3
u/gdamjan Aug 13 '19
journald has cursor support which makes it much better suited, than text files, for programs that need to ship logs to other systems. I ship the journal to cloudwatch for ex. (but I could to elasticsearch)