# Filebeat run at startup

**URL:** <https://discuss.elastic.co/t/filebeat-run-at-startup/304802>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 16, 2022, 10:14am UTC](https://discuss.elastic.co/t/filebeat-run-at-startup/304802 "2022-05-16T10:14:54Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bigboy0706](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bigboy0706](https://discuss.elastic.co/u/Bigboy0706)\
**Post date:** [May 16, 2022, 10:14am UTC](https://discuss.elastic.co/t/filebeat-run-at-startup/304802/1 "2022-05-16T10:14:54Z")

</div>

Hi,

I am trying to set up a Filebeat to collect the MacOS endpoint logs.  
May I know any command or general setting I could set to autostart the Filebeat after rebooting the MacOS?  
Thanks.

Best Regards,

Leo Yeung

---

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 16, 2022, 11:23am UTC](https://discuss.elastic.co/t/filebeat-run-at-startup/304802/2 "2022-05-16T11:23:31Z")

</div>

Hi,

did you install filebeat using brew ?

> **[filebeat](https://formulae.brew.sh/formula/filebeat)**
>
> Homebrew’s package index

---

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 16, 2022, 2:38pm UTC](https://discuss.elastic.co/t/filebeat-run-at-startup/304802/3 "2022-05-16T14:38:02Z")

</div>

Hi,

check this too,

> **[Install Elastic Filebeat as daemon on OSX - Koen Van Impe - vanimpe.eu](https://www.vanimpe.eu/2021/09/25/install-elastic-filebeat-as-daemon-on-osx/)**
>
> Install Elastic Filebeat as daemon on OSX - Koen Van Impe - vanimpe.eu - Filebeat Filebeat is a lightweight shipper for logs. You can use it to collect logs from endpoints and store them centrally in Elastic. You can use it to

> [@Deploying Filebeat on MacOS X](https://discuss.elastic.co/t/deploying-filebeat-on-macos-x/37785/11):
>
> This is the plist file I put into /Library/LaunchDaemons/: \<?xml version="1.0" encoding="UTF-8"?\> \<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"\> \<plist version="1.0"\> \<dict\> \<key\>Label\</key\> \<string\>co.elastic.filebeat\</string\> \<key\>ProgramArguments\</key\> \<array\> \<string\>/Applications/Filebeat/filebeat\</string\> \<string\>-c\</string\> \<string\>/Applications/Filebeat/filebeat.yml\</string\> \</array\> …

---

<div class="post-metadata">

**Author:** ![Bigboy0706](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bigboy0706](https://discuss.elastic.co/u/Bigboy0706)\
**Post date:** [May 18, 2022, 7:51am UTC](https://discuss.elastic.co/t/filebeat-run-at-startup/304802/4 "2022-05-18T07:51:58Z")

</div>

Hi, thanks for the reply.  
Here is my plist

```auto
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>Label</key>
	<string>co.elastic.filebeat</string>
	<key>ProgramArguments</key>
	<array>
		<string>/Applications/Filebeat/filebeat</string>
		<string>-c</string>
		<string>/Application/Filebeat/filebeat.yml</string>
	<string>--strict.perms=false</string>
	</array>
    	<key>RunAtLoad</key>
	<true/>
</dict>
</plist>

```

After I loaded it in my launchctl, it would show the following error

launchctl list | grep filebeat

- 1 co.elastic.filebeat

system.log:  
com.apple.xpc.launchd[1] (co.elastic.filebeat[74508]): Service exited with abnormal code: 1

Any advice?  
Thanks

---

<div class="post-metadata">

**Author:** ![ibra\_013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ibra_013/32/104827_2.png) [@ibra\_013](https://discuss.elastic.co/u/ibra_013)\
**Post date:** [May 18, 2022, 10:15am UTC](https://discuss.elastic.co/t/filebeat-run-at-startup/304802/5 "2022-05-18T10:15:15Z")

</div>

Hi,

i used brew for filebeat installation which created by default the plist file,

```auto
/opt/homebrew/bin/brew list filebeat
/opt/homebrew/Cellar/filebeat/8.2.0/.bottle/etc/ (25 files)
/opt/homebrew/Cellar/filebeat/8.2.0/bin/filebeat
/opt/homebrew/Cellar/filebeat/8.2.0/homebrew.filebeat.service
/opt/homebrew/Cellar/filebeat/8.2.0/homebrew.mxcl.filebeat.plist
/opt/homebrew/Cellar/filebeat/8.2.0/kibana/7/ (181 files)
/opt/homebrew/Cellar/filebeat/8.2.0/libexec/bin/filebeat

```

i added services formulae to the brew

```auto
 /opt/homebrew/bin/brew tap homebrew/services

```

Then i started the Filebeat service

```auto
/opt/homebrew/bin/brew start services filebeat

```

```auto
[sudo] brew services start (formula|--all|--file=):
    Start the service formula immediately and register it to launch at login
(or boot).

```

to check the service status

```auto
/opt/homebrew/bin/brew services info filebeat
filebeat (homebrew.mxcl.filebeat)
Running: ✔
Loaded: ✔
Schedulable: ✘
User: username
PID: number

```

i rebooted the Mac and the Filebeat service was running.

> **[Starting and Stopping Background Services with Homebrew](https://thoughtbot.com/blog/starting-and-stopping-background-services-with-homebrew)**
>
> Don’t fiddle with launctl when there’s a better way.

---

<div class="post-metadata">

**Author:** ![Bigboy0706](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bigboy0706](https://discuss.elastic.co/u/Bigboy0706)\
**Post date:** [May 20, 2022, 1:52am UTC](https://discuss.elastic.co/t/filebeat-run-at-startup/304802/6 "2022-05-20T01:52:20Z")

</div>

Hi,

Thanks for the reply.

As some requirement, it can't install via homebrew.

Any alternative way to do so?

Thanks.

Leo

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2022, 3:53am UTC](https://discuss.elastic.co/t/filebeat-run-at-startup/304802/7 "2022-06-17T03:53:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.