# Deploying Filebeat on MacOS X **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 22, 2015, 7:03pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785 "2015-12-22T19:03:25Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![dirkhschulz](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dirkhschulz](https://discuss.elastic.co/u/dirkhschulz)\ **Post date:** [December 22, 2015, 7:03pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/1 "2015-12-22T19:03:25Z")
Hi all, I am looking into deploying filebeat on Mac OS X (10.11). The package does not contain the wrapper binary filebeat-god, so the question is how to daemonize filebeat properly. Starting it manually I can use "./filebeat -e -c filebeat.yml &" to dispatch ist from my shell, but for handing it over to launchd that would be poor. Anyone out there already using it on MacOS X? Any hint or help is appreciated. Dirk ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [December 23, 2015, 12:38am UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/2 "2015-12-23T00:38:04Z")
I don't know anyone that has deployed Filebeat on OSX. You'll need to assemble a plist for use with launchd. filebeat-god should not be needed since launchd provides that functionality including KeepAlive. See the launchd [man page](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man5/launchd.plist.5.html). When you have a working plist please consider opening a pull request in [beats-packer](https://github.com/elastic/beats-packer) so we can add it to OSX package. Or if you aren't comfortable with a PR, just post it here. ---
**Author:** ![dirkhschulz](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dirkhschulz](https://discuss.elastic.co/u/dirkhschulz)\ **Post date:** [December 23, 2015, 6:04am UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/3 "2015-12-23T06:04:46Z")
Hi Andrew, thanks for your fast anwer. I am familiar with launchd and it's plist, my question was not about that. My question is about running filebeat as a daemon on Mac OS X. On Linux, daemonizing is done by the filebeat-god wrapper. On Mac OS X I can only daemonize it by using shell magic: calling it with a "&" in the end. That is good for manually starting it, but not for launchd since launchd does not rely on shell magic. So the question is: How do I daemonize it properly on Mac OS X? Of course I will PR a working co.elastic.filebeat.plist if I have one. Thanks, Dirk ---
**Author:** ![dirkhschulz](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dirkhschulz](https://discuss.elastic.co/u/dirkhschulz)\ **Post date:** [December 23, 2015, 6:22am UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/4 "2015-12-23T06:22:57Z")
This is what launchd complains about when it tries to call filebeat with "-e" and "-c /path/to/filebeat.yml": Dec 23 07:20:18 pmacl11sh-001 com.apple.xpc.launchd[1] (co.elastic.filebeat): This service is defined to be constantly running and is inherently inefficient. Dec 23 07:20:18 pmacl11sh-001 com.apple.xpc.launchd[1] (co.elastic.filebeat[70678]): Service could not initialize: 15C50: xpcproxy + 12644 [1472][13E77DA5-3602-31BF-B074-49D4EE27E9D8]: 0xd ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [December 23, 2015, 4:24pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/5 "2015-12-23T16:24:55Z")
don't really know launchd. Consider opening a ticket in [beats-packer](https://github.com/elastic/beats-packer/issues) including your config. Maybe we can iterate on this. Thanks for looking into this, Steffen ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [December 23, 2015, 4:36pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/6 "2015-12-23T16:36:39Z")
Check the permissions on the plist (0xd is a Permission Denied). The permissions should be 644 on the plist and 755 on the directory containing the plist (and all owned by root). For security purposes the file can only be writable by the user it runs as. Based on the man page you don't need to daemonize the process. In fact, it uses the words "MUST NOT". Hopefully I am interpreting it correctly. I think this is also similar to how systemd works, you don't need to daemonize. ```auto $ pwd /topbeat-1.0.1-darwin $ ls -la total 12688 drwxr-xr-x 6 root wheel 204 Dec 23 10:47 . drwxr-xr-x 34 root wheel 1224 Dec 23 10:31 .. -rw-r--r-- 1 root wheel 492 Dec 23 10:47 co.elastic.topbeatd.plist -rwxr-xr-x 1 root wheel 6474076 Dec 17 08:26 topbeat -rw-r--r-- 1 root wheel 2493 Dec 17 08:26 topbeat.template.json -rw-r--r-- 1 akroh wheel 8504 Dec 23 11:25 topbeat.yml $ sudo launchctl load co.elastic.topbeatd.plist $ ps -ef | grep top 0 46224 1 0 11:29AM ?? 0:00.02 /topbeat-1.0.1-darwin/topbeat -c /topbeat-1.0.1-darwin/topbeat.yml $ tail -F /var/log/system.log | grep --line-buffered "co.elastic" Dec 23 11:29:48 macbook13 com.apple.xpc.launchd[1] (co.elastic.topbeatd): This service is defined to be constantly running and is inherently inefficient. ``` ---
**Author:** ![dirkhschulz](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dirkhschulz](https://discuss.elastic.co/u/dirkhschulz)\ **Post date:** [January 11, 2016, 10:08am UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/7 "2016-01-11T10:08:36Z")
Hi Andrew, that helped me, thanks very much. My fault was to use an administrative user to run filebeat (I try to use root as seldom as possible) - that was leading to permissions issues, I guess. Now I have filebeat working (I have put the registry to /Library/Application Support/Filebeat/), I just did not not test filebeat's own logging - I guess I will do that only in a troubleshooting case. Now where can I provide the plist and yml I use? Just post it here or anywhere else? Cheers, Dirk ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [January 11, 2016, 1:39pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/8 "2016-01-11T13:39:39Z")
Glad you got it working. Probably currently the best place for documentation is posting it here. Make sure to post it as "code". ---
**Author:** ![dirkhschulz](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dirkhschulz](https://discuss.elastic.co/u/dirkhschulz)\ **Post date:** [January 11, 2016, 2:09pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/9 "2016-01-11T14:09:05Z")
hmm - I am sorry, but I did not find any hint on how to post something as code. Using html tags named "code" removes the xml tags from the plist content. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [January 11, 2016, 2:27pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/10 "2016-01-11T14:27:57Z")
Can you try using three ` (backtick) to start and end the code you want to post? This should have the same outcome as andrew used above. ---
**Author:** ![dirkhschulz](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dirkhschulz](https://discuss.elastic.co/u/dirkhschulz)\ **Post date:** [January 11, 2016, 5:45pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/11 "2016-01-11T17:45:12Z")
This is the plist file I put into /Library/LaunchDaemons/: ```auto Label co.elastic.filebeat ProgramArguments /Applications/Filebeat/filebeat -c /Applications/Filebeat/filebeat.yml KeepAlive ``` This is the filebeat.yml I use: ```auto filebeat: prospectors: - paths: - /private/var/log/system.log - /private/var/log/accountpolicy.log - /private/var/log/install.log input_type: log document_type: syslog registry_file: /Library/Application Support/Filebeat/registry output: logstash: hosts: ["10.23.46.12:5044"] shipper: logging: ``` To make this work, I created "/Library/Application Support/Filebeat". The job was registered with launchd using: ```auto launchctl load /Library/LaunchDaemons/co.elastic.filebeat.plist ``` Verification can be done using ```auto TheMac:~ root# ps -ef | grep filebeat 0 1371 1 0 7:55AM ?? 0:00.01 /Applications/Filebeat/filebeat -c /Applications/Filebeat/filebeat.yml 0 1373 1357 0 7:55AM ttys000 0:00.00 grep filebeat ``` Caveats: ATM launchd starts the job again after a reboot of the mac, but filebeat does not ship any logs until the job is unloaded and loaded again manually. Funny thing is, filebeat updates the registry file - this leads to old log lines not being shipped after manuall reload, just new ones. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [January 11, 2016, 6:05pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/12 "2016-01-11T18:05:16Z")
Thanks for sharing. It would probably be helpful to others if you could share the commands used to install and verify. ---
**Author:** ![dirkhschulz](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dirkhschulz](https://discuss.elastic.co/u/dirkhschulz)\ **Post date:** [January 12, 2016, 7:03am UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/13 "2016-01-12T07:03:01Z")
Done. Now I ran into another issue: After a reboot of the mac the launchd job was reloaded automatically (above verification is positive), but filebeat does not ship any logs until the job is unloaded and loaded again manually. Funny thing is, filebeat updates the registry file even before the manual restart - this leads to old log lines not being shipped after manual reload, just new ones. This happened on 3 Macs, I would take it to be reproducible. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [January 12, 2016, 3:01pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/14 "2016-01-12T15:01:05Z")
We will need some logs in order to diagnose anything. Can you enable debug logging to a file in your filebeat.yml. ```auto logging: to_files: true files: path: /my/log/dir level: debug selectors: ['*'] ``` I am thinking it could be an issue with network availability at the time launchd starts the Filebeat service. ---
**Author:** ![BrianM-CMHR](https://avatars.discourse-cdn.com/v4/letter/b/a698b9/32.png) [@BrianM-CMHR](https://discuss.elastic.co/u/BrianM-CMHR)\ **Post date:** [February 1, 2016, 10:00pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/15 "2016-02-01T22:00:20Z")
For usage within a museum for analytics we are just running it as a user level agent (LaunchAgent instead of LaunchDaemon) Here is the LaunchAgent I created for it: ``` Label co.elastic.filebeat ProgramArguments /users/username/filebeat/filebeat -e -c /users/username/filebeat/filebeat.yml -d "publish" RunAtLoad KeepAlive ``` ` For a LaunchAgent the .plist needs to have the user as the owner with read/write the group as read only, and everyone as read only. (can either be done through GUI, or terminal with chown then chmod 644 ) while a LaunchDaemon would be owned by root (with the same permissions for group and everyone) - as was mentioned in an earlier reply here. For those not familiar, a LaunchAgent will only startup the process once the correct user logs in while a LaunchDaemon starts up with the computer and doesn't require a user to login. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/16 "2017-07-05T21:56:06Z")