file: installation-layout.asciidoc
https://www.elastic.co/guide/en/fleet/current/installation-layout.html

It appears that as of 8.6.0, we log to logs/elastic-agent-*.ndjson for both agent and beats shippers.

But Widget in installation layout doc contains outdated -json.log references:

/Library/Elastic/Agent/data/elastic-agent-*/logs/elastic-agent-json.log
Log files for Elastic Agent[1]

/Library/Elastic/Agent/data/elastic-agent-/logs/default/-json.log
Log files for Beats shippers[1]

The footnote to that widget seems correct though.

[1] Logs file names end with a date and optional number: log-date.ndjson, log-date-1.ndjson, and so on as new files are created during rotation.

Here are the logs directory contents on an 8.6.0 Linux tar install with Filebeat, metricbeat, and auditbeat in use:

root@lubuntu:/opt/Elastic/Agent/data/elastic-agent-b79a5d/logs# ls -l /opt/Elastic/Agent/data/elastic-agent-b79a5d/logs
total 10428
-rw------- 1 root root 10484891 Apr 25 20:27 elastic-agent-20230425-1.ndjson
-rw------- 1 root root    81316 Apr 26 12:29 elastic-agent-20230425-2.ndjson
-rw------- 1 root root    98710 Apr 25 12:12 elastic-agent-20230425.ndjson

There isn't a separate directory for Beats shippers. They are consolidated to the elastic-agent-*.ndjson file.

See the same in 8.7.0 and on a MacOS install.