docs: add 4th step in migrate-to-filestream

filebeat/docs/howto/migrate-to-filestream.asciidoc

@@ -234,6 +234,13 @@ The example configuration shown earlier needs to be adjusted as well:
 |backoff.max
 |===
 
+=== Step 4
+
+The events produced by `filestream` input conatains `take_over` tag.
+You can filter on this tag in Kibana and see the events which came from a filestream in the "take over" mode. 
+
+Once you start receiving event with this tag, you can remove `take_over: true` and restart the fileinput again.
+
 === If something went wrong
 
 If for whatever reason you'd like to revert the configuration after running the migrated configuration