Add Apple notarization info

Fixes #11588

docs/static/modules.asciidoc

@@ -110,6 +110,31 @@ For a list of available module settings, see the documentation for the module.
 [[overriding-logstash-module-settings]]
 ==== Specify module settings at the command line
 
+[IMPORTANT]
+.macOS Gatekeeper warnings
+====
+Apple's rollout of stricter notarization requirements affected the notarization
+of the {version} {ls} artifacts. If macOS Catalina displays a dialog when you
+first run {ls} that interrupts it, you will need to take an action to allow it
+to run.
+To prevent Gatekeeper checks on the {ls} files, run the following command on the
+downloaded `.tar.gz` archive or the directory to which was extracted:
+[source,sh]
+----
+xattr -d -r com.apple.quarantine <archive-or-directory>
+----
+For example, if the `.tar.gz` file was extracted to the default
+logstash-{version} directory, the command is:
+[source,sh,subs="attributes"]
+----
+xattr -d -r com.apple.quarantine logstash-{version}
+----
+Alternatively, you can add a security override for both `jdk.app` and
+`controller.app` by following the instructions in the _How to open an app that
+hasn’t been notarized or is from an unidentified developer_ section of
+https://support.apple.com/en-us/HT202491[Safely open apps on your Mac].
+====
+
 You can override module settings by specifying one or more configuration
 overrides when you start Logstash. To specify an override, you use the `-M`
 command line option:

docs/static/plugin-manager.asciidoc

@@ -6,6 +6,32 @@ packages called gems and hosted on RubyGems.org. The plugin manager accessed via
 lifecycle of plugins in your Logstash deployment. You can install, remove and upgrade plugins using the Command Line
 Interface (CLI) invocations described below.
 
+[IMPORTANT]
+.macOS Gatekeeper warnings
+====
+Apple's rollout of stricter notarization requirements affected the notarization
+of the {version} {ls} artifacts. If macOS Catalina displays a dialog when you
+first run {ls} that interrupts it, you will need to take an action to allow it
+to run.
+To prevent Gatekeeper checks on the {ls} files, run the following command on the
+downloaded `.tar.gz` archive or the directory to which was extracted:
+[source,sh]
+----
+xattr -d -r com.apple.quarantine <archive-or-directory>
+----
+For example, if the `.tar.gz` file was extracted to the default
+logstash-{version} directory, the command is:
+[source,sh,subs="attributes"]
+----
+xattr -d -r com.apple.quarantine logstash-{version}
+----
+Alternatively, you can add a security override for both `jdk.app` and
+`controller.app` by following the instructions in the _How to open an app that
+hasn’t been notarized or is from an unidentified developer_ section of
+https://support.apple.com/en-us/HT202491[Safely open apps on your Mac].
+====
+
+
 [float]
 [[http-proxy]]
 === Proxy configuration

docs/static/running-logstash-command-line.asciidoc

@@ -1,6 +1,32 @@
 [[running-logstash-command-line]]
 === Running Logstash from the Command Line
 
+[IMPORTANT]
+.macOS Gatekeeper warnings
+====
+Apple's rollout of stricter notarization requirements affected the notarization
+of the {version} {ls} artifacts. If macOS Catalina displays a dialog when you
+first run {ls} that interrupts it, you will need to take an action to allow it
+to run.
+To prevent Gatekeeper checks on the {ls} files, run the following command on the
+downloaded `.tar.gz` archive or the directory to which was extracted:
+[source,sh]
+----
+xattr -d -r com.apple.quarantine <archive-or-directory>
+----
+For example, if the `.tar.gz` file was extracted to the default
+logstash-{version} directory, the command is:
+[source,sh,subs="attributes"]
+----
+xattr -d -r com.apple.quarantine logstash-{version}
+----
+Alternatively, you can add a security override for both `jdk.app` and
+`controller.app` by following the instructions in the _How to open an app that
+hasn’t been notarized or is from an unidentified developer_ section of
+https://support.apple.com/en-us/HT202491[Safely open apps on your Mac].
+====
+
+
 To run Logstash from the command line, use the following command:
 
 [source,shell]