Filebeat run at startup


I am trying to set up a Filebeat to collect the MacOS endpoint logs.
May I know any command or general setting I could set to autostart the Filebeat after rebooting the MacOS?

Best Regards,

Leo Yeung


did you install filebeat using brew ?


check this too,

Hi, thanks for the reply.
Here is my plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "">
<plist version="1.0">

After I loaded it in my launchctl, it would show the following error

launchctl list | grep filebeat

  • 1 co.elastic.filebeat

system.log:[1] (co.elastic.filebeat[74508]): Service exited with abnormal code: 1

Any advice?


i used brew for filebeat installation which created by default the plist file,

/opt/homebrew/bin/brew list filebeat
/opt/homebrew/Cellar/filebeat/8.2.0/.bottle/etc/ (25 files)
/opt/homebrew/Cellar/filebeat/8.2.0/kibana/7/ (181 files)

i added services formulae to the brew

 /opt/homebrew/bin/brew tap  homebrew/services

Then i started the Filebeat service

/opt/homebrew/bin/brew start services filebeat
[sudo] brew services start (formula|--all|--file=):
    Start the service formula immediately and register it to launch at login
(or boot).

to check the service status

/opt/homebrew/bin/brew services info filebeat
filebeat (homebrew.mxcl.filebeat)
Running: ✔
Loaded: ✔
Schedulable: ✘
User: username
PID: number

i rebooted the Mac and the Filebeat service was running.


Thanks for the reply.

As some requirement, it can't install via homebrew.

Any alternative way to do so?



This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.