Add test to guarantee data is not reingested when the journald input is restarted

[pierrehilbert]

Issue

Meta issue: #37086
To have journald GA, we should ensure that we are covering key scenarios with enough testing.

Acceptance Criteria

Tests are in place to confirm:

• We don't have data duplication when the input is restarted
• We have an at least once delivery guarantee
• Performances are comparable with filestream reading syslog

[elasticmachine]

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

[belimawr]

@pierrehilbert I believe it does not make sense to compare the performance of the Journald input with Filestream reading from syslog, at least not as part of this issue that is about not duplicating data on restart.

If we need a comparison in performance between Filestream reading syslog logs and Journald input reading the same data, we can create a separated issue for this.

What do you think?

[pierrehilbert]

Agree this doesn't need to be covered in this issue.
I still think we should run a performance comparison to measure the impact and be able to share the information to our customers if this is relevant (and therefore highlight rsyslog as an alternative to avoid this performance impact).
WDYT?

[belimawr]

Agree this doesn't need to be covered in this issue. I still think we should run a performance comparison to measure the impact and be able to share the information to our customers if this is relevant (and therefore highlight rsyslog as an alternative to avoid this performance impact). WDYT?

Yes, we can run those benchmarks, it's gonna be an interesting exercise.