diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageTests.java
index b53878459ef6d..50799e338ba40 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageTests.java
@@ -22,6 +22,7 @@
 import com.carrotsearch.randomizedtesting.generators.RandomStrings;
 import org.apache.http.client.fluent.Request;
 import org.elasticsearch.packaging.util.FileUtils;
+import org.elasticsearch.packaging.util.Packages;
 import org.elasticsearch.packaging.util.Shell.Result;
 import org.junit.BeforeClass;
 
@@ -46,7 +47,6 @@
 import static org.elasticsearch.packaging.util.Packages.SYSTEMD_SERVICE;
 import static org.elasticsearch.packaging.util.Packages.assertInstalled;
 import static org.elasticsearch.packaging.util.Packages.assertRemoved;
-import static org.elasticsearch.packaging.util.Packages.clearJournal;
 import static org.elasticsearch.packaging.util.Packages.installPackage;
 import static org.elasticsearch.packaging.util.Packages.remove;
 import static org.elasticsearch.packaging.util.Packages.restartElasticsearch;
@@ -342,10 +342,9 @@ public void test90DoNotCloseStderrWhenQuiet() throws Exception {
             append(tempConf.resolve("elasticsearch.yml"), "discovery.zen.ping.unicast.hosts:15172.30.5.3416172.30.5.35, 172.30.5.17]\n");
 
             // Make sure we don't pick up the journal entries for previous ES instances.
-            clearJournal(sh);
+            Packages.JournaldWrapper journald = new Packages.JournaldWrapper(sh);
             runElasticsearchStartCommand();
-
-            final Result logs = sh.run("journalctl -u elasticsearch.service");
+            final Result logs = journald.getLogs();
 
             assertThat(logs.stdout, containsString("Failed to load settings from [elasticsearch.yml]"));
         });
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/util/Packages.java b/qa/os/src/test/java/org/elasticsearch/packaging/util/Packages.java
index 26817a60889fe..b8dc221163f81 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/util/Packages.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/util/Packages.java
@@ -49,7 +49,6 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
 
 public class Packages {
 
@@ -280,31 +279,6 @@ public static Shell.Result runElasticsearchStartCommand(Shell sh) throws IOExcep
         return sh.runIgnoreExitCode("service elasticsearch start");
     }
 
-    /**
-     * Clears the systemd journal. This is intended to clear the <code>journalctl</code> output
-     * before a test that checks the journal output.
-     */
-    public static void clearJournal(Shell sh) {
-        if (isSystemd()) {
-            sh.run("rm -rf /run/log/journal/*");
-            final Result result = sh.runIgnoreExitCode("systemctl restart systemd-journald");
-
-            // Sometimes the restart fails on Debian 10 with:
-            //    Job for systemd-journald.service failed because the control process exited with error code.
-            //    See "systemctl status systemd-journald.service" and "journalctl -xe" for details.]
-            //
-            // ...so run these commands in an attempt to figure out what's going on.
-            if (result.isSuccess() == false) {
-                logger.error("Failed to restart systemd-journald: " + result);
-
-                logger.error(sh.runIgnoreExitCode("systemctl status systemd-journald.service"));
-                logger.error(sh.runIgnoreExitCode("journalctl -xe"));
-
-                fail("Couldn't clear the systemd journal as restarting systemd-journald failed");
-            }
-        }
-    }
-
     public static void assertElasticsearchStarted(Shell sh, Installation installation) throws Exception {
         waitForElasticsearch(installation);
 
@@ -332,4 +306,41 @@ public static void restartElasticsearch(Shell sh, Installation installation) thr
         }
         assertElasticsearchStarted(sh, installation);
     }
+
+    /**
+     * A small wrapper for retrieving only recent journald logs for the
+     * Elasticsearch service. It works by creating a cursor for the logs
+     * when instantiated, and advancing that cursor when the {@code clear()}
+     * method is called.
+     */
+    public static class JournaldWrapper {
+        private Shell sh;
+        private String cursor;
+
+        /**
+         * Create a new wrapper for Elasticsearch JournalD logs.
+         * @param sh A shell with appropriate permissions.
+         */
+        public JournaldWrapper(Shell sh) {
+            this.sh = sh;
+            clear();
+        }
+
+        /**
+         * "Clears" the journaled messages by retrieving the latest cursor
+         * for Elasticsearch logs and storing it in class state.
+         */
+        public void clear() {
+            cursor = sh.run("sudo journalctl --unit=elasticsearch.service --lines=0 --show-cursor -o cat" +
+                " | sed -e 's/-- cursor: //'").stdout.trim();
+        }
+
+        /**
+         * Retrieves all log messages coming after the stored cursor.
+         * @return Recent journald logs for the Elasticsearch service.
+         */
+        public Result getLogs() {
+            return sh.run("journalctl -u elasticsearch.service --after-cursor='" + this.cursor + "'");
+        }
+    }
 }