From c45190f667157c19222944e7a809945cdf447f34 Mon Sep 17 00:00:00 2001 From: Vihas Makwana Date: Wed, 12 Jun 2024 12:55:38 +0530 Subject: [PATCH 1/2] docs: add 4th step in migrate-to-filestream --- filebeat/docs/howto/migrate-to-filestream.asciidoc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/filebeat/docs/howto/migrate-to-filestream.asciidoc b/filebeat/docs/howto/migrate-to-filestream.asciidoc index a57105adb3e..c833d9d0978 100644 --- a/filebeat/docs/howto/migrate-to-filestream.asciidoc +++ b/filebeat/docs/howto/migrate-to-filestream.asciidoc @@ -234,6 +234,13 @@ The example configuration shown earlier needs to be adjusted as well: |backoff.max |=== +=== Step 4 + +The events produced by `filestream` input with `take_over: true` contain `take_over` tag. +You can filter on this tag in Kibana and see the events which came from a filestream in the "take_over" mode. + +Once you start receiving event with this tag, you can remove `take_over: true` and restart the fileinput again. + === If something went wrong If for whatever reason you'd like to revert the configuration after running the migrated configuration From 50a0e2f3d2fd3bcedaae4beefce062f4f9cae613 Mon Sep 17 00:00:00 2001 From: Pierre HILBERT Date: Wed, 12 Jun 2024 15:53:15 +0200 Subject: [PATCH 2/2] Update filebeat/docs/howto/migrate-to-filestream.asciidoc Co-authored-by: David Kilfoyle <41695641+kilfoyle@users.noreply.github.com> --- filebeat/docs/howto/migrate-to-filestream.asciidoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/filebeat/docs/howto/migrate-to-filestream.asciidoc b/filebeat/docs/howto/migrate-to-filestream.asciidoc index db8f9d0dd08..55c05a5b46d 100644 --- a/filebeat/docs/howto/migrate-to-filestream.asciidoc +++ b/filebeat/docs/howto/migrate-to-filestream.asciidoc @@ -236,10 +236,10 @@ The example configuration shown earlier needs to be adjusted as well: === Step 4 -The events produced by `filestream` input with `take_over: true` contain `take_over` tag. +The events produced by `filestream` input with `take_over: true` contain a `take_over` tag. You can filter on this tag in Kibana and see the events which came from a filestream in the "take_over" mode. -Once you start receiving event with this tag, you can remove `take_over: true` and restart the fileinput again. +Once you start receiving events with this tag, you can remove `take_over: true` and restart the fileinput again. === If something went wrong