Enabling "Include Source" in Custom macOS Unified Logs Integration Causes Agent Failure
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
**Description**
When configuring the Custom macOS Unified Logs integration, enabling the **Include source** toggle causes the Elastic Agent input to fail with a decoding error.
This happens whether **Include source** is enabled alone or together with other toggles.
**Steps to Reproduce**
1. Go to Integrations -> Custom macOS Unified Logs.
2. Create or edit an existing integration policy.
3. Set a valid predicate in Predicate parameter.,
4. Leave other fields as default.
5. Enable the Include source toggle (alone or along with other toggles).
6. Save the integration and observe the agent status under Fleet -> Agents.
**Expected Behavior**
The integration should successfully collect macOS unified logs even when **Include source** is enabled.
**Actual Behavior**
- The Elastic Agent becomes Unhealthy.
- The integration shows a Failed state with the following error message:
```
decoding error: decoding failed due to the following error(s):
'streams[0].source' expected a map or struct, got "bool"
```
**Environment Details**
- Elastic Agent version: 9.1.5
- Integration: Custom macOS Unified Logs
- Host OS: macOS (Elastic Agent locally installed)
**Working configuration**
- All toggles disabled, or
- All toggles enabled except Include source.
**Failing configuration**
- Include source enabled (alone or along with other toggles).
**Screenshots**
Contributor guide
Research direction
Start by reproducing the Custom macOS Unified Logs integration with Include source enabled and inspect the generated configuration associated with the reported decoding error. Confirm the fix by saving the integration successfully, keeping the Elastic Agent healthy, and verifying that unified logs are collected with Include source enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, macos
- Domain
- observability-sre
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100