You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When configuring the Custom macOS Unified Logs integration, enabling the Include source toggle causes the Elastic Agent input to fail with a decoding error.
This happens whether Include source is enabled alone or together with other toggles.
Steps to Reproduce
Go to Integrations -> Custom macOS Unified Logs.
Create or edit an existing integration policy.
Set a valid predicate in Predicate parameter.,
Leave other fields as default.
Enable the Include source toggle (alone or along with other toggles).
Save the integration and observe the agent status under Fleet -> Agents.
Expected Behavior
The integration should successfully collect macOS unified logs even when Include source is enabled.
Actual Behavior
The Elastic Agent becomes Unhealthy.
The integration shows a Failed state with the following error message:
decoding error: decoding failed due to the following error(s):
'streams[0].source' expected a map or struct, got "bool"
Environment Details
Elastic Agent version: 9.1.5
Integration: Custom macOS Unified Logs
Host OS: macOS (Elastic Agent locally installed)
Working configuration
All toggles disabled, or
All toggles enabled except Include source.
Failing configuration
Include source enabled (alone or along with other toggles).
Activity
infra-vault-gh-plugin-prod commentedon Oct 9, 2026
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)