Proposed commit message

The system module did not define an ID at the root of the config, that made the V2 input loader only start the first journald input it saw because they both ended up with the same identifier (type, ID and path). This is fixed by defining an ID at the root of the configuration templates.

The journald input now also adds the input_id key to its loggers and a non-fatal error is now logged at debug level.

The system-logs input is now marked as experimental instead of stable.

Fix lint warnings by moving toJournalConfig to input_linux.go

Move TestSystemLogsCanUseLogInput to a file without the
linux build constraint so it can run on all OSes supported by the
system integration.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• [ ] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

## Disruptive User Impact
## Author's Checklist

How to test this PR locally

1. Run Filebeat with the following filebeat.yml and modules.d/system.yml (adjust credentials/addresses as necessary)

   filebeat.yml

   filebeat.inputs:
     - type: journald
       id: my-journald-normal-input
       tags:
          - journald-input
     - type: filestream
       id: my-filestream-id
       paths:
         - /tmp/flog.log
   
   filebeat.config.modules:
     path: ${path.config}/modules.d/*.yml
     reload.enabled: false
     reload.period: 1s
   
   setup.template:
     settings:
       index.number_of_shards: 1
   
   setup.kibana:
     host: "http://kibana:5601"
     username: admin
     password: testing
     ssl.verification_mode: none
   
   output.elasticsearch:
     hosts: ["http://elasticsearch:9200"]
     preset: latency
     protocol: "http"
   
     username: admin
     password: testing
     ssl.verification_mode: none

   modules.d/system.yml

   - module: system
     syslog:
       enabled: true
       var.use_journald: true
       input:
         tags:
           - from-journald
   
     auth:
       enabled: true
       var.use_journald: true
       var.tags:
         - from-journald

2. Go to Discover in Kibana, filter by tags: from-journald

3. Look at fileset.name from the events, make sure auth and syslog are there

Related issues

• Closes [System module] Only one instance of Journald runs when both syslog and auth filesets are enabled #41378

## Use cases
## Screenshots
## Logs