Skip to content

Instantly share code, notes, and snippets.

@rcmelendez
Last active August 11, 2021 20:19
Show Gist options
  • Save rcmelendez/f2e0d1a6fccf13e9cb980371f90cf41e to your computer and use it in GitHub Desktop.
Save rcmelendez/f2e0d1a6fccf13e9cb980371f90cf41e to your computer and use it in GitHub Desktop.
Elastic Filebeat, Metricbeat, and Auditbeat launchd jobs for macOS. Tested on macOS Catalina with Beats 7.9.3.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>co.elastic.auditbeat</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/auditbeat/auditbeat</string>
<string>-c</string>
<string>/usr/local/auditbeat/auditbeat.yml</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>co.elastic.filebeat</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/filebeat/filebeat</string>
<string>-c</string>
<string>/usr/local/filebeat/filebeat.yml</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>co.elastic.metricbeat</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/metricbeat/metricbeat</string>
<string>-c</string>
<string>/usr/local/metricbeat/metricbeat.yml</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment