<source>
  @type exec
  <parse>
    @type json
  </parse>
  command sh /etc/td-agent/checkjournal.sh
  tag influx
</source>

<match influx.**>
  @type copy
  <store>
    @type stdout
  </store>
  <store>
    @type forward
    <server>
      name elk-server
      host 192.168.30.3
      port 10515
    </server>
  </store>
</match>


Checkjournal.sh : contains below cold

exec journalctl --since=now  -f -u  influxdb