Filebeat run at startup

Elastic Stack Beats
1

Hi,

I am trying to set up a Filebeat to collect the MacOS endpoint logs.
May I know any command or general setting I could set to autostart the Filebeat after rebooting the MacOS?
Thanks.

Best Regards,

Leo Yeung

2

Hi,

did you install filebeat using brew ?

3

Hi,

check this too,

4

Hi, thanks for the reply.
Here is my plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>Label</key>
	<string>co.elastic.filebeat</string>
	<key>ProgramArguments</key>
	<array>
		<string>/Applications/Filebeat/filebeat</string>
		<string>-c</string>
		<string>/Application/Filebeat/filebeat.yml</string>
	<string>--strict.perms=false</string>
	</array>
    	<key>RunAtLoad</key>
	<true/>
</dict>
</plist>

After I loaded it in my launchctl, it would show the following error

launchctl list | grep filebeat

  • 1 co.elastic.filebeat

system.log:
com.apple.xpc.launchd[1] (co.elastic.filebeat[74508]): Service exited with abnormal code: 1

Any advice?
Thanks

5

Hi,

i used brew for filebeat installation which created by default the plist file,

/opt/homebrew/bin/brew list filebeat
/opt/homebrew/Cellar/filebeat/8.2.0/.bottle/etc/ (25 files)
/opt/homebrew/Cellar/filebeat/8.2.0/bin/filebeat
/opt/homebrew/Cellar/filebeat/8.2.0/homebrew.filebeat.service
/opt/homebrew/Cellar/filebeat/8.2.0/homebrew.mxcl.filebeat.plist
/opt/homebrew/Cellar/filebeat/8.2.0/kibana/7/ (181 files)
/opt/homebrew/Cellar/filebeat/8.2.0/libexec/bin/filebeat

i added services formulae to the brew

 /opt/homebrew/bin/brew tap  homebrew/services

Then i started the Filebeat service

/opt/homebrew/bin/brew start services filebeat

[sudo] brew services start (formula|--all|--file=):
    Start the service formula immediately and register it to launch at login
(or boot).

to check the service status

/opt/homebrew/bin/brew services info filebeat
filebeat (homebrew.mxcl.filebeat)
Running: ✔
Loaded: ✔
Schedulable: ✘
User: username
PID: number

i rebooted the Mac and the Filebeat service was running.

6

Hi,

Thanks for the reply.

As some requirement, it can't install via homebrew.

Any alternative way to do so?

Thanks.

Leo