# Filebeat behaves different on different macOS versions

**URL:** <https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 19, 2018, 8:30am UTC](https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657 "2018-04-19T08:30:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![francisaugusto](https://avatars.discourse-cdn.com/v4/letter/f/c37758/32.png) [@francisaugusto](https://discuss.elastic.co/u/francisaugusto)\
**Post date:** [April 19, 2018, 8:30am UTC](https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657/1 "2018-04-19T08:30:39Z")

</div>

Hi there,

I have installed Filebeat 6.2.2 into different versions of macOS. These versions range from 10.10.5 to 10.13.4.  
My configuration file is setup to scan both the system logs as well as some json files on a folder.  
The thing is, the json data is uploaded flawlessly from the 10.13.4 machines, but not at all from lower versions of macOS (lower than 10.13).  
Is there anything in Filebeat that doesn't work with json on older macOS versions?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [April 19, 2018, 9:10am UTC](https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657/2 "2018-04-19T09:10:18Z")

</div>

There shouldn't be a difference. Can you share your configuration files and the log output from the filebeat instances that don't work?

---

<div class="post-metadata">

**Author:** ![francisaugusto](https://avatars.discourse-cdn.com/v4/letter/f/c37758/32.png) [@francisaugusto](https://discuss.elastic.co/u/francisaugusto)\
**Post date:** [April 19, 2018, 9:25am UTC](https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657/3 "2018-04-19T09:25:35Z")

</div>

Hi ruflin,  
Thanks for your answer. Yes, I'll get the configuration and post here. But the logs on the machines that don't work there is no mention whatsoever to the log files that are supposed to be scanned.

---

<div class="post-metadata">

**Author:** ![francisaugusto](https://avatars.discourse-cdn.com/v4/letter/f/c37758/32.png) [@francisaugusto](https://discuss.elastic.co/u/francisaugusto)\
**Post date:** [April 19, 2018, 10:46am UTC](https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657/4 "2018-04-19T10:46:37Z")

</div>

Here's the configuration:

```auto
    - type: log
      enabled: true
      paths:
       - /etc/tmp/logs/*.json
      json.keys_under_root: true
      json.add_error_key: true
      fields_under_root: true
      scan_frequency: 60s
      max_bytes: 51200

```

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [April 20, 2018, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657/5 "2018-04-20T14:45:47Z")

</div>

Any chance you could share the full config (without the passwords)? Don't see anything special yet but perhaps there is something else.

For the logs: Best enable debugging logging. This should provide much more information in which paths it looks for files etc. If possible, please also share it here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2018, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-behaves-different-on-different-macos-versions/128657/6 "2018-05-18T14:45:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.