Add delete options for Custom Filestream integration

[belimawr]

Proposed commit message

See title

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• Verify when the delete feature will be released
• Wait for the compatible Elastic-Agent/Filebeat to be released

How to test this PR locally

1. Create a log file > 1kb (e.g.: /tmp/flog.log)
2. Add the Custom Filestream integration configured to ingest the file you created and enable:
   1. "Delete files after they have been ingested"
   2. "Close Reader EOF"
3. Set "Grace period for deleting files" to 1m
4. Deploy and start the Elastic-Agent
5. Wait for the file to be fully read and removed.
6. Assert the log file has been removed

You can watch Filestream's logs by running:

elastic-agent logs -f -C 'filestream-default'| jq '{"ts": ."@timestamp", "lvl": ."log.level", "logger": ."log.logger", "m": .message}' -c

You will see the logs related to the delete feature:

{"ts":"2025-11-17T22:15:43.729Z","lvl":"info","logger":"input.filestream","m":"all events from '/tmp/flog.log' have been published, waiting for 1m0s grace period"}
{"ts":"2025-11-17T22:16:43.733Z","lvl":"info","logger":"input.filestream","m":"'/tmp/flog.log' removed"}

Related issues

• [Filebeat/Filestream] Delete ingested log files on EOF or inactive beats#43368

Screenshots

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[botelastic]

Hi! This PR has been stale for a while and we're going to close it as part of our cleanup procedure. We appreciate your contribution and would like to apologize if we have not been able to review it, due to the current heavy load of the team. Feel free to re-open this PR if you think it should stay open and is worth rebasing. Thank you for your contribution!

[sinzzor]

Hi! Any chance this could get some love? Would be lovely to have this GA feature in the integration as well.

[belimawr]

Hi! Any chance this could get some love? Would be lovely to have this GA feature in the integration as well.

I'm looking into that @sinzzor.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: b050aab

History

• 💚 Build #34239 succeeded 50ae387
• 💚 Build #24847 succeeded 5b918be

cc @belimawr

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[elastic-vault-github-plugin-prod]

Package filestream - 2.2.0 containing this change is available at https://epr.elastic.co/package/filestream/2.2.0/