IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Step 3: Use new option names If something went wrong »
Elastic Docs ›Filebeat Reference [8.15] ›How to guides ›Migrate log input configurations to filestream

Step 4

edit

Step 4

edit

The events produced by filestream input with take_over: true contain a take_over tag. You can filter on this tag in Kibana and see the events which came from a filestream in the "take_over" mode.

Once you start receiving events with this tag, you can remove take_over: true and restart the fileinput again.

« Step 3: Use new option names If something went wrong »