Elastic Agent on Mac in failed state

HaydenB0101
Thu, 26 Feb 2026 18:06:03 +0000
Elastic Agent

Hello, I am using the Custom macOS Unified Logs integration with elastic 8.18.8 in order to get logs from my mac device, and I getting errors from the agent

elastic-agent status
fleet
  status: (HEALTHY) Connected
elastic-agent
  status: (DEGRADED) 1 or more components/units in a failed state
  unifiedlogs-so-manager_logstash
  status: (HEALTHY) Healthy: communicating with pid '10838'
  unifiedlogs-so-manager_logstash-unifiedlogs-unifiedlogs-a963fc35-601c-43a7-a43e-feca5068d08a
  status: (FAILED) decoding error: decoding failed due to the following error(s):
    'streams[0].source' expected a map or struct, got "bool"

Is the problem from the integration or the device itself? I tested having it send logs/metrics and it communicates fine.

I was also wondering if there are any integrations that work well with Macs since many of the integrations don’t have OS/Hardware compatibility listed

2 posts - 1 participant