# Deploying Filebeat on MacOS X

**URL:** <https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 22, 2015, 7:03pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785 "2015-12-22T19:03:25Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![dirkhschulz](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dirkhschulz](https://discuss.elastic.co/u/dirkhschulz)\
**Post date:** [January 11, 2016, 5:45pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/11 "2016-01-11T17:45:12Z")

</div>

This is the plist file I put into /Library/LaunchDaemons/:

```auto
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>co.elastic.filebeat</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Applications/Filebeat/filebeat</string>
        <string>-c</string>
        <string>/Applications/Filebeat/filebeat.yml</string> 
    </array>
    <key>KeepAlive</key>
    <true/>
</dict>
</plist>

```

This is the filebeat.yml I use:

```auto
filebeat:
  prospectors:
    -
      paths:
      - /private/var/log/system.log
      - /private/var/log/accountpolicy.log
      - /private/var/log/install.log
      input_type: log
      document_type: syslog
  registry_file: /Library/Application Support/Filebeat/registry
output:
  logstash:
    hosts: ["10.23.46.12:5044"]
shipper:
logging:

```

To make this work, I created "/Library/Application Support/Filebeat".

The job was registered with launchd using:

```auto
launchctl load /Library/LaunchDaemons/co.elastic.filebeat.plist 

```

Verification can be done using

```auto
TheMac:~ root# ps -ef | grep filebeat
    0 1371 1 0 7:55AM ?? 0:00.01 /Applications/Filebeat/filebeat -c /Applications/Filebeat/filebeat.yml
    0 1373 1357 0 7:55AM ttys000 0:00.00 grep filebeat

```

Caveats: ATM launchd starts the job again after a reboot of the mac, but filebeat does not ship any logs until the job is unloaded and loaded again manually.  
Funny thing is, filebeat updates the registry file - this leads to old log lines not being shipped after manuall reload, just new ones.

---

_[View the full topic](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785)._