Adding macOS unified logging source to collectors by kroepke · Pull Request #26542 · Graylog2/graylog2-server

kroepke · 2026-07-01T15:14:16Z

Description

With Graylog2/collector#74 we can support native macOS unified logger sources again.

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Refactoring (non-breaking change)
Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

My code follows the code style of this project.
My change requires a change to the documentation.
I have requested a documentation update.
I have read the CONTRIBUTING document.
I have added tests to cover my changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…index type consistency Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

expose more settings to the ui but hide archive_path and end_time, as those would essentially be one-shot collection they would technically work but are not a good fit for our use case. the receiver has support, be graylog doesn't at this point

Copilot

Pull request overview

Adds end-to-end support for a new Collector source type, macos_unified_logging, enabling Graylog fleets to configure and ingest macOS Unified Logging data (aligned with the collector-side receiver reintroduction).

Changes:

Extends the web UI Collector source model and creation/edit form to support macos_unified_logging (predicate, start time, and optional durations).
Adds server-side source/receiver config models plus a log record processor that maps macos.* OTel attributes into GIM fields.
Updates onboarding defaults and test fixtures to include the new source and validate serialization/processing behavior.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`graylog2-web-interface/src/components/collectors/types.ts`	Adds the new `macos_unified_logging` source type and config typing.
`graylog2-web-interface/src/components/collectors/sources/SourceFormModal.tsx`	Adds form fields and duration handling for macOS unified logging sources.
`graylog2-web-interface/src/components/collectors/sources/SourceFormModal.test.tsx`	Adds UI tests covering macOS source field rendering and saved config.
`graylog2-web-interface/src/components/collectors/sources/Constants.ts`	Adds label for `macos_unified_logging` in the source type selector.
`graylog2-web-interface/src/components/collectors/sources/ColumnRenderers.tsx`	Widens the source type column to fit the new label.
`graylog2-web-interface/src/components/collectors/overview/onboarding/defaultSources.ts`	Adds a default “macOS Unified Logs” onboarding source template.
`graylog2-web-interface/src/components/collectors/overview/FleetCardsGrid.tsx`	Adjusts grid sizing to accommodate updated onboarding/cards layout.
`graylog2-web-interface/src/components/collectors/overview/FirstOnboarding.test.tsx`	Updates expectations to account for the additional default source.
`graylog2-server/src/test/resources/org/graylog/collectors/input/processor/macos-unified-log-record.json`	Adds an OTel fixture record representing macOS unified logging attributes.
`graylog2-server/src/test/java/org/graylog/collectors/input/processor/MacOSUnifiedLoggingRecordProcessorTest.java`	Adds unit tests for macOS record-to-field mapping and fixture parsing.
`graylog2-server/src/test/java/org/graylog/collectors/db/SourceDTOTest.java`	Registers the new subtype for DTO JSON round-trip tests.
`graylog2-server/src/test/java/org/graylog/collectors/db/SourceConfigTest.java`	Adds round-trip + receiver-config tests for the new source config fields.
`graylog2-server/src/test/java/org/graylog/collectors/config/receiver/MacOSUnifiedLoggingReceiverConfigTest.java`	Tests receiver defaults and serialization behavior.
`graylog2-server/src/main/java/org/graylog/collectors/input/processor/MacOSUnifiedLoggingRecordProcessor.java`	Implements mapping of `macos.*` attributes into GIM + macOS-prefixed fields.
`graylog2-server/src/main/java/org/graylog/collectors/db/MacOSUnifiedLoggingSourceConfig.java`	Adds new persisted source config and conversion to receiver config.
`graylog2-server/src/main/java/org/graylog/collectors/config/receiver/MacOSUnifiedLoggingReceiverConfig.java`	Adds the receiver config model with defaults and Go-duration serialization.
`graylog2-server/src/main/java/org/graylog/collectors/CollectorsModule.java`	Wires the new source subtype and record processor binding into the server module.
`changelog/unreleased/pr-26542.toml`	Adds an unreleased changelog entry for the new source type.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

bernd

First round of review.

bernd · 2026-07-21T17:26:39Z

+      <TimeUnitInput
+        label="Max poll interval"
+        update={updateDuration('max_poll_interval')}
+        value={pollInterval.duration}
+        unit={pollInterval.unit}
+        units={POLL_INTERVAL_UNITS}
+        enabled={config.max_poll_interval !== undefined}
+        help="Optional. How often the Collector checks for new log entries. Leave unchecked to use the default (30s)."
+      />
+      <TimeUnitInput
+        label="Max log age"
+        update={updateDuration('max_log_age')}
+        value={logAge.duration}
+        unit={logAge.unit}
+        units={LOG_AGE_UNITS}
+        enabled={config.max_log_age !== undefined}
+        help="Optional. On first start, how far back to backfill logs. Leave unchecked to use the default (24h)."
+      />


We should use the <TimeUnitInput/> component for both values and set the default values. I don't think we need the checkbox. Just adding the default values should be enough.

Component usage in events system configuration:

Good point, much cleaner and I added more sensible validations, too.

bernd · 2026-07-21T17:27:43Z

+  return (
+    <>
+      <Input
+        id="macos-predicate"


Should we just add the default predicate here? That makes the "secure default" visible for users.

Yes, adding it to the default config section in this file, rather than in the backend.

Co-authored-by: Bernd Ahlers <bernd@users.noreply.github.com>

… required start_date is no longer set, we only need max_log_age as the relative starting point and calculate `--start` values in the collector the predicate default now lives in the frontend only, the backend allows empty predicates (valid but probably impractical settings) improved validation for max_poll_interval and max_log_age in both frontend and backend

kroepke and others added 14 commits June 30, 2026 18:21

feat(collectors): add macOS unified logging receiver config

1450a37

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(collectors): add macOS unified logging source config

ba4b65f

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(collectors): map macOS unified logging records to GIM fields

315e969

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(collectors): add macOS unified logging source form

f5f6397

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(collectors): write macOS process_id/user_id as String for shared-…

4d3a7b0

…index type consistency Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Merge branch 'master' into feat/macos-unified-logging-receiver

66a5e03

Merge branch 'master' into feat/macos-unified-logging-receiver

d5313e1

Merge branch 'master' into feat/macos-unified-logging-receiver

2a2e8a0

we now have 4 sources instead of 3

113058d

give us a bit more space for longer titles in the fleet grid

d7d2c99

give macOS Unified Logging badge enough space in the column

15c737c

add changelog

c3f274c

Merge branch 'master' into feat/macos-unified-logging-receiver

47b4572

kroepke marked this pull request as ready for review July 14, 2026 15:09

kroepke requested review from a team and Copilot July 14, 2026 15:09

Copilot started reviewing on behalf of kroepke July 14, 2026 15:10 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread graylog2-server/src/main/java/org/graylog/collectors/db/MacOSUnifiedLoggingSourceConfig.java Outdated

Comment thread graylog2-server/src/main/java/org/graylog/collectors/db/MacOSUnifiedLoggingSourceConfig.java Outdated

kroepke added collector feature labels Jul 14, 2026

thll and others added 2 commits July 21, 2026 11:34

Merge branch 'master' into feat/macos-unified-logging-receiver

abe3d78

Merge branch 'master' into feat/macos-unified-logging-receiver

6bdce49

bernd requested changes Jul 21, 2026

View reviewed changes

kroepke and others added 6 commits July 22, 2026 11:33

Update changelog/unreleased/pr-26542.toml

36b5f20

Co-authored-by: Bernd Ahlers <bernd@users.noreply.github.com>

Update changelog/unreleased/pr-26542.toml

a7cfb2c

Co-authored-by: Bernd Ahlers <bernd@users.noreply.github.com>

prefer library functions over local reimplementations

6f558a1

need to restate defaults for onboarding

1f271b3

update comment

db0e77d

kroepke requested a review from bernd July 22, 2026 15:47

kroepke added 4 commits July 22, 2026 17:50

add license header

9e13a3e

address linter error

fd81271

adjusted tests since we no longer use start_time

79acb89

missed a test with new macos source config defaults

9c13c85

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Adding macOS unified logging source to collectors#26542

Adding macOS unified logging source to collectors#26542
kroepke wants to merge 26 commits into
masterfrom
feat/macos-unified-logging-receiver

kroepke commented Jul 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

bernd left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bernd Jul 21, 2026

Uh oh!

kroepke Jul 22, 2026

Uh oh!

bernd Jul 21, 2026

Uh oh!

kroepke Jul 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

kroepke commented Jul 1, 2026

Description

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

Checklist:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

bernd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bernd Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

kroepke Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

bernd Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

kroepke Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants