There are a few issues with the current logfile implementation: cannot read the same file from two differents inputs, problems when updating the registry, problems when an input is started with autodiscover, problems trying to stop a logfile input. (original PR #21427)

The logfile input is also a building block for the container input and the docker input (which is deprecated). The current implementation is not considered feature complete and doesn't implement the full feature set of the logfile input.

Filestream's tasks

• Meta issue Log file collector based on v2 input API #20243

Fleet's tasks

• Move internal log collection to the Filestream input
• Migrate integrations to use the Filestream input instead of the logfile input.