cscli explain --dsn "journalctl://filters=_SYSTEMD_UNIT=authelia.service" --type syslog
Journalctl acquisition has a DSN command which can be run by CrowdSec this is basically the same DSN that is exposed by cscli explain
This journactl will grab all logs so you can use other filters journalctl offers by tagging another &filters=<journalctl_filter> to get more refined results