diff --git a/changelog/fragments/1784889342-remove-system-hostfs.yaml b/changelog/fragments/1784889342-remove-system-hostfs.yaml
new file mode 100644
index 000000000000..b201b421fdcd
--- /dev/null
+++ b/changelog/fragments/1784889342-remove-system-hostfs.yaml
@@ -0,0 +1,45 @@
+# REQUIRED
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: breaking-change
+
+# REQUIRED for all kinds
+# Change summary; a 80ish characters long description of the change.
+summary: system.hostfs setting is removed in favor of `hostfs` setting only.
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# description:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# impact:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# action:
+
+# REQUIRED for all kinds
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: metricbeat
+
+# AUTOMATED
+# OPTIONAL to manually add other PR URLs
+# PR URL: A link the PR that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: https://github.com/elastic/beats/pull/52238
+
+# AUTOMATED
+# OPTIONAL to manually add other issue URLs
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+# issue: https://github.com/owner/repo/1234
diff --git a/docs/reference/metricbeat/metricbeat-metricset-system-process.md b/docs/reference/metricbeat/metricbeat-metricset-system-process.md
index c74dea4ef13e..dd189996f367 100644
--- a/docs/reference/metricbeat/metricbeat-metricset-system-process.md
+++ b/docs/reference/metricbeat/metricbeat-metricset-system-process.md
@@ -95,7 +95,9 @@ This metricset is available on:
 
 The process metricset supports both V1 and V2 (sometimes called unfied) cgroups controllers. However, on systems that are running a hybrid hierarchy, with both V1 and V2 controllers, metricbeat will only report one of the hierarchies for a given process. Is a process has both V1 and V2 hierarchies associated with it, metricbeat will check to see if the process is attached to any V2 controllers. If it is, it will report cgroups V2 metrics. If not, it will report V1 metrics.
 
-A workaround is also required if metricbeat is running inside docker on a hybrid system. Within docker, metricbeat won’t be able to see any V2 cgroups components. If you wish to monitor cgroups V2 from within docker on a hybrid system, you must mount the unified sysfs hierarchy (usually `/sys/fs/cgroups/unified`) inside the container, and then use `system.hostfs` to specify the filesystem root within the container.
+A workaround is also required if metricbeat is running inside docker on a hybrid system. Within docker, metricbeat won’t be able to see any V2 cgroups components. If you wish to monitor cgroups V2 from within docker on a hybrid system, you must mount the unified sysfs hierarchy (usually `/sys/fs/cgroups/unified`) inside the container, and then use `hostfs` to specify the filesystem root within the container. 
+
+{applies_to}`stack: ga 9.6.0` The legacy `system.hostfs` setting is no longer accepted. Use the module-level `hostfs` setting instead.
 
 This is a default metricset. If the host module is unconfigured, this metricset is enabled by default.
 
diff --git a/metricbeat/internal/sysinit/init.go b/metricbeat/internal/sysinit/init.go
index ac4bd7076859..124f1664bdce 100644
--- a/metricbeat/internal/sysinit/init.go
+++ b/metricbeat/internal/sysinit/init.go
@@ -22,7 +22,6 @@ import (
 	"fmt"
 	"sync"
 
-	"github.com/elastic/beats/v7/libbeat/common/cfgwarn"
 	"github.com/elastic/beats/v7/libbeat/management"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 )
@@ -39,11 +38,6 @@ type HostFSConfig struct {
 	HostFS string `config:"hostfs"`
 }
 
-// MetricbeatHostFSConfig carries config information for the hostfs setting
-type MetricbeatHostFSConfig struct {
-	HostFS string `config:"system.hostfs"`
-}
-
 // InitSystemModule initializes either either the system or linux module. This will produce different modules depending on if we're running under agent or not.
 func InitSystemModule(base mb.BaseModule) (mb.Module, error) {
 	// common code for the base use case of `hostfs` being set at the module-level
@@ -90,8 +84,6 @@ func metricbeatInit(base mb.BaseModule, modulePath string) (mb.Module, error) {
 
 }
 
-// A user can supply either `system.hostfs` or `hostfs`.
-// In additon, we will probably want to change Integration Config values to `hostfs` as well.
 // We need to figure out which one we got, if any.
 // Returns false if no config value was set
 func findConfigValue(base mb.BaseModule) (string, bool, error) {
@@ -105,17 +97,6 @@ func findConfigValue(base mb.BaseModule) (string, bool, error) {
 		return partialConfig.HostFS, true, nil
 	}
 
-	legacyConfig := MetricbeatHostFSConfig{}
-	err = base.UnpackConfig(&legacyConfig)
-	if err != nil {
-		return "", false, fmt.Errorf("error unpacking legacy config: %w", err)
-	}
-	if legacyConfig.HostFS != "" {
-		base.Logger.Warn(cfgwarn.Deprecate("8.0.0", "The system.hostfs config value will be removed, use `hostfs` from within the module config."))
-		// Only fallback to this if the user didn't set anything else
-		return legacyConfig.HostFS, true, nil
-	}
-
 	return "/", false, nil
 
 }
diff --git a/metricbeat/module/system/process/_meta/docs.md b/metricbeat/module/system/process/_meta/docs.md
index 719ee6623dfd..d2543e6e267b 100644
--- a/metricbeat/module/system/process/_meta/docs.md
+++ b/metricbeat/module/system/process/_meta/docs.md
@@ -83,4 +83,6 @@ This metricset is available on:
 
 The process metricset supports both V1 and V2 (sometimes called unfied) cgroups controllers. However, on systems that are running a hybrid hierarchy, with both V1 and V2 controllers, metricbeat will only report one of the hierarchies for a given process. Is a process has both V1 and V2 hierarchies associated with it, metricbeat will check to see if the process is attached to any V2 controllers. If it is, it will report cgroups V2 metrics. If not, it will report V1 metrics.
 
-A workaround is also required if metricbeat is running inside docker on a hybrid system. Within docker, metricbeat won’t be able to see any V2 cgroups components. If you wish to monitor cgroups V2 from within docker on a hybrid system, you must mount the unified sysfs hierarchy (usually `/sys/fs/cgroups/unified`) inside the container, and then use `system.hostfs` to specify the filesystem root within the container.
+A workaround is also required if metricbeat is running inside docker on a hybrid system. Within docker, metricbeat won’t be able to see any V2 cgroups components. If you wish to monitor cgroups V2 from within docker on a hybrid system, you must mount the unified sysfs hierarchy (usually `/sys/fs/cgroups/unified`) inside the container, and then use `hostfs` to specify the filesystem root within the container. 
+
+{applies_to}`stack: ga 9.6.0` The legacy `system.hostfs` setting is no longer accepted. Use the module-level `hostfs` setting instead.