How can you capture Linux systemd logs using the CloudWatch Agent?

One solution might be to use Datadog's Vector product to facilitate logging. Vector can use journald as a "source" and CloudWatch Logs and a "sink".

Another thought is to modify the systemd service file to save logging events to a physical file and then configure the CloudWatch agent to process that file. However, this requires us to manage a log file, and on a long running system that is tedious. I don't really want to worry about filling up the disk with old log information. And it seems much more efficient to just process journald directly.

However, I've never used Vector and can't be sure how it will work in practice. It may be that using a physical log file is easier and more reliable.

Wouldn't it be great if CloudWatch logs could talk to journald directly? Or even process a STDOUT stream? That way we could pipe information directly into CW without having to go through all this trouble.