diff --git a/filebeat/docs/howto/migrate-to-filestream.asciidoc b/filebeat/docs/howto/migrate-to-filestream.asciidoc
index 30057fab725..55c05a5b46d 100644
--- a/filebeat/docs/howto/migrate-to-filestream.asciidoc
+++ b/filebeat/docs/howto/migrate-to-filestream.asciidoc
@@ -234,6 +234,13 @@ The example configuration shown earlier needs to be adjusted as well:
 |backoff.max
 |===
 
+=== Step 4
+
+The events produced by `filestream` input with `take_over: true` contain a `take_over` tag.
+You can filter on this tag in Kibana and see the events which came from a filestream in the "take_over" mode. 
+
+Once you start receiving events with this tag, you can remove `take_over: true` and restart the fileinput again.
+
 === If something went wrong
 
 If for whatever reason you'd like to revert the configuration after running the migrated configuration