The cherry on the cake is that you practically cannot filter journald. The only option is limiting by severity (e.g. errors and higher) or switch to non persistent journald storage and forward to rsyslog and filter there.
Am a bit vague on the details but sometimes a driver goes bezerk and starts logging many times per second, e.g. a bug in amdgpu after resume from suspend. Took a while to get that filtered which luckily was only possible because it were kernel messages (dmesg), but for a while I had to disae persistent kernel logging which is dat from ideal.
I get that for certain core parts simplicity is more important than features. But journald is just too basic to enable persistent storage but I also don't want to switch it off.
If you have systemd>=253 you can make use of LogFilterPatterns[0] (in .service files), but it's really unpredictable, cumbersome to work with, and does not work with user services or non-service log sources.
[0]: https://www.freedesktop.org/software/systemd/man/latest/syst...
Thanks for this, was not aware this was added. Though better would be to have a global option for this, and a tunable whether to filter this completely or only for persistent storage.
For the last few days I have been monitoring journald with iotop and found in my case storage use was not excessive at the moment. And there are rate limit options, but I'd really like there to be system-wide filtering options.
For servers I rarely see journald persistence enabled while it is actually very valuable for debugging crashes and other issues. Way easier than regular log files. Though also more fragile and more difficult, so improvements are very welcome.