diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index a464c3559a3..be66d95f066 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -121,6 +121,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - system/socket: Fix dataset using 100% CPU and becoming unresponsive in some scenarios. {pull}19033[19033] {pull}19764[19764]
 - system/socket: Fixed tracking of long-running connections. {pull}19033[19033]
 - Fix bug in `httpjson` that prevented `first_event` getting updated. {pull}26407[26407]
+- Fix bug in the Syslog input that misparsed rfc5424 days starting with 0. {pull}26419[26419]
+- Do not close filestream harvester if an unexpected error is returned when close.on_state_change.* is enabled. {pull}26411[26411] 
 
 *Filebeat*
 
diff --git a/filebeat/input/filestream/filestream.go b/filebeat/input/filestream/filestream.go
index 908d8558145..5e72dc927b9 100644
--- a/filebeat/input/filestream/filestream.go
+++ b/filebeat/input/filestream/filestream.go
@@ -179,14 +179,21 @@ func (f *logFile) shouldBeClosed() bool {
 
 	info, statErr := f.file.Stat()
 	if statErr != nil {
+		// return early if the file does not exist anymore and the reader should be closed
+		if f.closeRemoved && errors.Is(statErr, os.ErrNotExist) {
+			f.log.Debugf("close.on_state_change.removed is enabled and file %s has been removed", f.file.Name())
+			return true
+		}
+
+		// If an unexpected error happens we keep the reader open hoping once everything will go back to normal.
 		f.log.Errorf("Unexpected error reading from %s; error: %s", f.file.Name(), statErr)
-		return true
+		return false
 	}
 
 	if f.closeRenamed {
 		// Check if the file can still be found under the same path
 		if !isSameFile(f.file.Name(), info) {
-			f.log.Debugf("close_renamed is enabled and file %s has been renamed", f.file.Name())
+			f.log.Debugf("close.on_state_change.renamed is enabled and file %s has been renamed", f.file.Name())
 			return true
 		}
 	}
@@ -194,7 +201,7 @@ func (f *logFile) shouldBeClosed() bool {
 	if f.closeRemoved {
 		// Check if the file name exists. See https://github.com/elastic/filebeat/issues/93
 		if file.IsRemoved(f.file) {
-			f.log.Debugf("close_removed is enabled and file %s has been removed", f.file.Name())
+			f.log.Debugf("close.on_state_change.removed is enabled and file %s has been removed", f.file.Name())
 			return true
 		}
 	}