elastic / elastic/beats

Enabling "Include Source" in Custom macOS Unified Logs Integration Causes Agent Failure

Open
#47,296 1 comment 2 reactions 0 assignees View on GitHub
needs_team
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

**Description**

When configuring the Custom macOS Unified Logs integration, enabling the **Include source** toggle causes the Elastic Agent input to fail with a decoding error.
This happens whether **Include source** is enabled alone or together with other toggles.

**Steps to Reproduce**

1. Go to Integrations -> Custom macOS Unified Logs.
2. Create or edit an existing integration policy.
3. Set a valid predicate in Predicate parameter.,
4. Leave other fields as default.
5. Enable the Include source toggle (alone or along with other toggles).
6. Save the integration and observe the agent status under Fleet -> Agents.

**Expected Behavior**

The integration should successfully collect macOS unified logs even when **Include source** is enabled.

**Actual Behavior**

- The Elastic Agent becomes Unhealthy.
- The integration shows a Failed state with the following error message:

```
decoding error: decoding failed due to the following error(s):
'streams[0].source' expected a map or struct, got "bool"

```

**Environment Details**

- Elastic Agent version: 9.1.5
- Integration: Custom macOS Unified Logs
- Host OS: macOS (Elastic Agent locally installed)

**Working configuration**

- All toggles disabled, or
- All toggles enabled except Include source.

**Failing configuration**
- Include source enabled (alone or along with other toggles).

**Screenshots**

Image

Image

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Custom macOS Unified Logs integration with Include source enabled and inspect the generated configuration associated with the reported decoding error. Confirm the fix by saving the integration successfully, keeping the Elastic Agent healthy, and verifying that unified logs are collected with Include source enabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, macos
Domain
observability-sre
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.