Debian 12 has stopped writing system logs to traditional log files and now only uses journald by default (see release notes).

This makes the system integration unable to ingest some data because it expects to read direct from files.

We need to find the best way to detect the whether files or journald is used to store the system logs and configure the correct input (log/filestream or journald).

There is a similar issue in the Beats repository to handle the same situatin in Filebeat's system module: elastic/beats#40526.