New component: macOS Unified Logging Receiver

[Caleb-Hurshman]

Building and distributing outside this repository

• I understand I can use and distribute my component outside of this repository.

The purpose and use-cases of the new component

This issue is to track upstreaming our implementation of the macosunifiedloggingreceiver.

The macOS Unified Logging Receiver collects logs from macOS systems using the native log command. This receiver supports both live system logs and archived log files (.logarchive).

Example configuration for the component

macosunifiedlogging:
  format: ndjson
  max_poll_interval: 30s
  max_log_age: 24h

Telemetry data types supported

Logs

Code Owner(s)

@Caleb-Hurshman <- would appreciate a second codeowner

Sponsor (optional)

@atoulme

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[iblancasa]

Is there any reason why this cannot be done with filelogreceiver?

[Caleb-Hurshman]

Is there any reason why this cannot be done with filelogreceiver?

@iblancasa
The filelogreceiver could collect unparsed binary data from *.tracev3 files, but would be unable to parse that data. The binary format is proprietary, and the libraries Apple has available to interface with the data require a solution that isn't pure Go (e.g., including C code in an encoding, requiring CGO to be enabled). Additionally, the last time I checked, the filelogreceiver only supports text based encodings, not binary.

This solution is by far the lowest effort by interfacing directly with the log command.

[paulojmdias]

I'm not sure, but maybe an encoding extension should be enough for achieving this.

It seems Beats have this support already.

• https://github.com/elastic/beats/blob/main/docs/reference/filebeat/filebeat-input-unifiedlogs.md
• https://www.elastic.co/docs/reference/integrations/unifiedlogs
• https://github.com/elastic/beats/blob/main/x-pack/filebeat/input/unifiedlogs/input.go
• https://github.com/jaakkoo/macoslogbeat/blob/master/beater/MacosLogBeat.go

[atoulme]

I would like to sponsor this component.

[Caleb-Hurshman]

I'm not sure, but maybe an encoding extension should be enough for achieving this.

@paulojmdias Looking at their code, they are executing the same log command that I use in the downstream receiver implementation. Since this command handles gathering and parsing the logs, it makes more sense to have this as a receiver. Unless there is some way to decouple the gathering and the parsing within the command, which sounds complex.
I would be glad to hear your thoughts.