diff --git a/x-pack/filebeat/input/cel/input.go b/x-pack/filebeat/input/cel/input.go
index 13d7fff2d86..5979d99496e 100644
--- a/x-pack/filebeat/input/cel/input.go
+++ b/x-pack/filebeat/input/cel/input.go
@@ -719,6 +719,11 @@ func getLimit(which string, rateLimit map[string]interface{}, log *logp.Logger)
 	return limit, true
 }
 
+// lumberjackTimestamp is a glob expression matching the time format string used
+// by lumberjack when rolling over logs, "2006-01-02T15-04-05.000".
+// https://github.com/natefinch/lumberjack/blob/4cb27fcfbb0f35cb48c542c5ea80b7c1d18933d0/lumberjack.go#L39
+const lumberjackTimestamp = "[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]-[0-9][0-9]-[0-9][0-9].[0-9][0-9][0-9]"
+
 func newClient(ctx context.Context, cfg config, log *logp.Logger, reg *monitoring.Registry) (*http.Client, *httplog.LoggingRoundTripper, error) {
 	if !wantClient(cfg) {
 		return nil, nil, nil
@@ -763,13 +768,13 @@ func newClient(ctx context.Context, cfg config, log *logp.Logger, reg *monitorin
 	} else if cfg.Resource.Tracer != nil {
 		// We have a trace log name, but we are not enabled,
 		// so remove all trace logs we own.
-		ext := filepath.Ext(cfg.Resource.Tracer.Filename)
-		base := strings.TrimSuffix(cfg.Resource.Tracer.Filename, ext)
 		err = os.Remove(cfg.Resource.Tracer.Filename)
 		if err != nil && !errors.Is(err, fs.ErrNotExist) {
 			log.Errorw("failed to remove request trace log", "path", cfg.Resource.Tracer.Filename, "error", err)
 		}
-		paths, err := filepath.Glob(base + "-*" + ext)
+		ext := filepath.Ext(cfg.Resource.Tracer.Filename)
+		base := strings.TrimSuffix(cfg.Resource.Tracer.Filename, ext)
+		paths, err := filepath.Glob(base + "-" + lumberjackTimestamp + ext)
 		if err != nil {
 			log.Errorw("failed to collect request trace log path names", "error", err)
 		}