diff --git a/x-pack/filebeat/input/streaming/crowdstrike.go b/x-pack/filebeat/input/streaming/crowdstrike.go
index 699b99b3d8d6..abbe37a6b288 100644
--- a/x-pack/filebeat/input/streaming/crowdstrike.go
+++ b/x-pack/filebeat/input/streaming/crowdstrike.go
@@ -10,7 +10,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -203,11 +202,11 @@ func (s *falconHoseStream) followSession(ctx context.Context, cli *http.Client,
 		if offset > 0 {
 			feedURL, err := url.Parse(r.FeedURL)
 			if err != nil {
-				log.Fatalf("failed to parse feed url: %v", err)
+				return state, Warning{fmt.Errorf("failed to parse feed url: %w", err)}
 			}
 			feedQuery, err := url.ParseQuery(feedURL.RawQuery)
 			if err != nil {
-				log.Fatalf("failed to parse feed query: %v", err)
+				return state, Warning{fmt.Errorf("failed to parse feed query: %v", err)}
 			}
 			feedQuery.Set("offset", strconv.Itoa(offset))
 			feedURL.RawQuery = feedQuery.Encode()