update documentation

filebeat/docs/howto/migrate-to-filestream.asciidoc

@@ -247,3 +247,8 @@ and return to old `log` inputs the files that were taken by `filestream` inputs,
 6. Run Filebeat with the old configuration (no `filestream` inputs with `take_over: true`).
 
 NOTE: Reverting to backups might cause some events to repeat, depends on the amount of time the new configuration was running.
+
+=== Debugging on Kibana
+
+Events produced by `filestream` with `take_over: true` contains `take_over` tag.
+You can filter on this tag in Kibana and see the events which came from a filestream in the "take over" mode. 

filebeat/input/filestream/input.go

@@ -383,7 +383,7 @@ func (inp *filestream) readFromSource(
 
 		// add "take_over" tag if `take_over` is set to true
 		if inp.takeOver {
-			mapstr.AddTags(message.Fields, []string{"take_over"})
+			_ = mapstr.AddTags(message.Fields, []string{"take_over"})
 		}
 
 		if err := p.Publish(message.ToEvent(), s); err != nil {