Skip to content

Enabling "Include Source" in Custom macOS Unified Logs Integration Causes Agent Failure #47296

Open

Description

@muskan-agarwal26

Description

When configuring the Custom macOS Unified Logs integration, enabling the Include source toggle causes the Elastic Agent input to fail with a decoding error.
This happens whether Include source is enabled alone or together with other toggles.

Steps to Reproduce

  1. Go to Integrations -> Custom macOS Unified Logs.
  2. Create or edit an existing integration policy.
  3. Set a valid predicate in Predicate parameter.,
  4. Leave other fields as default.
  5. Enable the Include source toggle (alone or along with other toggles).
  6. Save the integration and observe the agent status under Fleet -> Agents.

Expected Behavior

The integration should successfully collect macOS unified logs even when Include source is enabled.

Actual Behavior

  • The Elastic Agent becomes Unhealthy.
  • The integration shows a Failed state with the following error message:
decoding error: decoding failed due to the following error(s):
'streams[0].source' expected a map or struct, got "bool"

Environment Details

  • Elastic Agent version: 9.1.5
  • Integration: Custom macOS Unified Logs
  • Host OS: macOS (Elastic Agent locally installed)

Working configuration

  • All toggles disabled, or
  • All toggles enabled except Include source.

Failing configuration

  • Include source enabled (alone or along with other toggles).

Screenshots

Image Image

Activity

  1. removed
    needs_teamIndicates that the issue/PR needs a Team:* label
    on Oct 9, 2026
  2. infra-vault-gh-plugin-prod commented on Oct 9, 2026

    @infra-vault-gh-plugin-prod

    Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions