Adding macOS unified logging source to collectors - #26542
Merged
Conversation
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…index type consistency Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
expose more settings to the ui but hide archive_path and end_time, as those would essentially be one-shot collection they would technically work but are not a good fit for our use case. the receiver has support, be graylog doesn't at this point
Contributor
There was a problem hiding this comment.
Pull request overview
Adds end-to-end support for a new Collector source type, macos_unified_logging, enabling Graylog fleets to configure and ingest macOS Unified Logging data (aligned with the collector-side receiver reintroduction).
Changes:
- Extends the web UI Collector source model and creation/edit form to support
macos_unified_logging(predicate, start time, and optional durations). - Adds server-side source/receiver config models plus a log record processor that maps
macos.*OTel attributes into GIM fields. - Updates onboarding defaults and test fixtures to include the new source and validate serialization/processing behavior.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
graylog2-web-interface/src/components/collectors/types.ts |
Adds the new macos_unified_logging source type and config typing. |
graylog2-web-interface/src/components/collectors/sources/SourceFormModal.tsx |
Adds form fields and duration handling for macOS unified logging sources. |
graylog2-web-interface/src/components/collectors/sources/SourceFormModal.test.tsx |
Adds UI tests covering macOS source field rendering and saved config. |
graylog2-web-interface/src/components/collectors/sources/Constants.ts |
Adds label for macos_unified_logging in the source type selector. |
graylog2-web-interface/src/components/collectors/sources/ColumnRenderers.tsx |
Widens the source type column to fit the new label. |
graylog2-web-interface/src/components/collectors/overview/onboarding/defaultSources.ts |
Adds a default “macOS Unified Logs” onboarding source template. |
graylog2-web-interface/src/components/collectors/overview/FleetCardsGrid.tsx |
Adjusts grid sizing to accommodate updated onboarding/cards layout. |
graylog2-web-interface/src/components/collectors/overview/FirstOnboarding.test.tsx |
Updates expectations to account for the additional default source. |
graylog2-server/src/test/resources/org/graylog/collectors/input/processor/macos-unified-log-record.json |
Adds an OTel fixture record representing macOS unified logging attributes. |
graylog2-server/src/test/java/org/graylog/collectors/input/processor/MacOSUnifiedLoggingRecordProcessorTest.java |
Adds unit tests for macOS record-to-field mapping and fixture parsing. |
graylog2-server/src/test/java/org/graylog/collectors/db/SourceDTOTest.java |
Registers the new subtype for DTO JSON round-trip tests. |
graylog2-server/src/test/java/org/graylog/collectors/db/SourceConfigTest.java |
Adds round-trip + receiver-config tests for the new source config fields. |
graylog2-server/src/test/java/org/graylog/collectors/config/receiver/MacOSUnifiedLoggingReceiverConfigTest.java |
Tests receiver defaults and serialization behavior. |
graylog2-server/src/main/java/org/graylog/collectors/input/processor/MacOSUnifiedLoggingRecordProcessor.java |
Implements mapping of macos.* attributes into GIM + macOS-prefixed fields. |
graylog2-server/src/main/java/org/graylog/collectors/db/MacOSUnifiedLoggingSourceConfig.java |
Adds new persisted source config and conversion to receiver config. |
graylog2-server/src/main/java/org/graylog/collectors/config/receiver/MacOSUnifiedLoggingReceiverConfig.java |
Adds the receiver config model with defaults and Go-duration serialization. |
graylog2-server/src/main/java/org/graylog/collectors/CollectorsModule.java |
Wires the new source subtype and record processor binding into the server module. |
changelog/unreleased/pr-26542.toml |
Adds an unreleased changelog entry for the new source type. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
bernd
requested changes
Jul 21, 2026
Co-authored-by: Bernd Ahlers <bernd@users.noreply.github.com>
Co-authored-by: Bernd Ahlers <bernd@users.noreply.github.com>
… required start_date is no longer set, we only need max_log_age as the relative starting point and calculate `--start` values in the collector the predicate default now lives in the frontend only, the backend allows empty predicates (valid but probably impractical settings) improved validation for max_poll_interval and max_log_age in both frontend and backend
bernd
requested changes
Jul 31, 2026
bernd
left a comment
bernd
left a comment
Member
There was a problem hiding this comment.
A few stylisting and wording comments. The rest looks good and works!
bernd
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This adds support for collecting data via native macOS unified logger sources (collector support in Graylog2/collector#74).
Motivation and Context
Many important subsystems no longer write to log files on modern macOS systems, instead they use the unified logging system.
How Has This Been Tested?
Unit tests.