From 4389d86d76a7ac1c82bae514e22dacc591ef638f Mon Sep 17 00:00:00 2001
From: Radovan Ondas <ondas.radovan@gmail.com>
Date: Wed, 7 Nov 2018 18:32:52 +0100
Subject: [PATCH] Fix macOS default log path for elasticsearch module based on
 brew paths (#8939)

* Fix macOS default log path for elasticsearch module based on homebrew paths.

* Add changelog record for macOS default path fix.

(cherry picked from commit 3f07231ce2b9943c5ca853dda351068c120f5670)
---
 CHANGELOG.asciidoc                                     | 1 +
 filebeat/module/elasticsearch/audit/manifest.yml       | 2 +-
 filebeat/module/elasticsearch/deprecation/manifest.yml | 2 +-
 filebeat/module/elasticsearch/gc/manifest.yml          | 4 ++--
 filebeat/module/elasticsearch/server/manifest.yml      | 2 +-
 filebeat/module/elasticsearch/slowlog/manifest.yml     | 4 ++--
 6 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index 446dc42760b7..05f92115d09a 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -71,6 +71,7 @@ https://github.com/elastic/beats/compare/v6.4.0...6.x[Check the HEAD diff]
 - Support multiline logs in logstash/log fileset of Filebeat. {pull}8562[8562]
 - Fix improperly set config for CRI Flag in Docker Input {pull}8899[8899]
 - Just enabling the `elasticsearch` fileset and starting Filebeat no longer causes an error. {pull}8891[8891]
+- Fix macOS default log path for elasticsearch module based on homebrew paths. {pul}8939[8939]
 
 *Heartbeat*
 
diff --git a/filebeat/module/elasticsearch/audit/manifest.yml b/filebeat/module/elasticsearch/audit/manifest.yml
index 39598c99cb4d..00298cdf9812 100644
--- a/filebeat/module/elasticsearch/audit/manifest.yml
+++ b/filebeat/module/elasticsearch/audit/manifest.yml
@@ -5,7 +5,7 @@ var:
     default:
       - /var/log/elasticsearch/*_access.log
     os.darwin:
-      - /usr/local/elasticsearch/*_access.log
+      - /usr/local/var/lib/elasticsearch/*_access.log
     os.windows:
       - c:/ProgramData/Elastic/Elasticsearch/logs/*_access.log
 
diff --git a/filebeat/module/elasticsearch/deprecation/manifest.yml b/filebeat/module/elasticsearch/deprecation/manifest.yml
index 63bc20cb74e0..3d334014422b 100644
--- a/filebeat/module/elasticsearch/deprecation/manifest.yml
+++ b/filebeat/module/elasticsearch/deprecation/manifest.yml
@@ -5,7 +5,7 @@ var:
     default:
       - /var/log/elasticsearch/*_deprecation.log
     os.darwin:
-      - /usr/local/elasticsearch/*_deprecation.log
+      - /usr/local/var/lib/elasticsearch/*_deprecation.log
     os.windows:
       - c:/ProgramData/Elastic/Elasticsearch/logs/*_deprecation.log
 
diff --git a/filebeat/module/elasticsearch/gc/manifest.yml b/filebeat/module/elasticsearch/gc/manifest.yml
index 7ea640f7d65b..64d84c3c82ab 100644
--- a/filebeat/module/elasticsearch/gc/manifest.yml
+++ b/filebeat/module/elasticsearch/gc/manifest.yml
@@ -6,8 +6,8 @@ var:
       - /var/log/elasticsearch/gc.log.[0-9]*
       - /var/log/elasticsearch/gc.log
     os.darwin:
-      - /usr/local/elasticsearch/gc.log.[0-9]*
-      - /usr/local/elasticsearch/gc.log
+      - /usr/local/var/lib/elasticsearch/gc.log.[0-9]*
+      - /usr/local/var/lib/elasticsearch/gc.log
     os.windows:
       - c:/ProgramData/Elastic/Elasticsearch/logs/gc.log.*
       - c:/ProgramData/Elastic/Elasticsearch/logs/gc.log
diff --git a/filebeat/module/elasticsearch/server/manifest.yml b/filebeat/module/elasticsearch/server/manifest.yml
index 2b6d89843460..f327b1405f2a 100644
--- a/filebeat/module/elasticsearch/server/manifest.yml
+++ b/filebeat/module/elasticsearch/server/manifest.yml
@@ -5,7 +5,7 @@ var:
     default:
       - /var/log/elasticsearch/*.log
     os.darwin:
-      - /usr/local/elasticsearch/*.log
+      - /usr/local/var/lib/elasticsearch/*.log
     os.windows:
       - c:/ProgramData/Elastic/Elasticsearch/logs/*.log
 
diff --git a/filebeat/module/elasticsearch/slowlog/manifest.yml b/filebeat/module/elasticsearch/slowlog/manifest.yml
index ec46d411f9ae..5fc6306b9fe2 100644
--- a/filebeat/module/elasticsearch/slowlog/manifest.yml
+++ b/filebeat/module/elasticsearch/slowlog/manifest.yml
@@ -6,8 +6,8 @@ var:
       - /var/log/elasticsearch/*_index_search_slowlog.log
       - /var/log/elasticsearch/*_index_indexing_slowlog.log
     os.darwin:
-      - /usr/local/elasticsearch/*_index_search_slowlog.log
-      - /usr/local/elasticsearch/*_index_indexing_slowlog.log
+      - /usr/local/var/lib/elasticsearch/*_index_search_slowlog.log
+      - /usr/local/var/lib/elasticsearch/*_index_indexing_slowlog.log
     os.windows:
       - c:/ProgramData/Elastic/Elasticsearch/logs/*_index_search_slowlog.log
       - c:/ProgramData/Elastic/Elasticsearch/logs/*_index_indexing_slowlog.log