Filebeat behaves different on different macOS versions

Elastic Stack Beats
1

Hi there,

I have installed Filebeat 6.2.2 into different versions of macOS. These versions range from 10.10.5 to 10.13.4.
My configuration file is setup to scan both the system logs as well as some json files on a folder.
The thing is, the json data is uploaded flawlessly from the 10.13.4 machines, but not at all from lower versions of macOS (lower than 10.13).
Is there anything in Filebeat that doesn't work with json on older macOS versions?

2

There shouldn't be a difference. Can you share your configuration files and the log output from the filebeat instances that don't work?

3

Hi ruflin,
Thanks for your answer. Yes, I'll get the configuration and post here. But the logs on the machines that don't work there is no mention whatsoever to the log files that are supposed to be scanned.

4

Here's the configuration:

    - type: log
      enabled: true
      paths:
       - /etc/tmp/logs/*.json
      json.keys_under_root: true
      json.add_error_key: true
      fields_under_root: true
      scan_frequency: 60s
      max_bytes: 51200
5

Any chance you could share the full config (without the passwords)? Don't see anything special yet but perhaps there is something else.

For the logs: Best enable debugging logging. This should provide much more information in which paths it looks for files etc. If possible, please also share it here.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.