Support both take over configurations

[belimawr]

Proposed commit message

The take over mode configuration changed format when its functionality was expanded. It changed
from a single boolean

take_over: true

To an object:

take_over:
  enabled: true
  from_ids: ["foo", "bar"]

This commit makes both formats accepted with no change on how the feature works.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

## Disruptive User Impact
## Author's Checklist

How to test this PR locally

Run the tests

cd filebeat

# Unit Tests
go test -run="TestTakeOverCfg|TestGetTakeOver" -count=1 -v ./input/filestream/...

# Integration tests
mage buildSystemTestBinary
go test -tags=integration -run=TestFilestreamTakeOver -v -count=1 ./tests/integration

For manual testing, follow the procedures from #42624 and use both configuration formats.

Related issues

• Closes Update take_over configuration to keep compatibility with the previous version #45221

## Use cases
## Screenshots
## Logs

[github-actions]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @belimawr? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[github-actions]

🔍 Preview links for changed docs

• docs/reference/filebeat/filebeat-input-filestream.md

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[AndersonQ]

No blocker, but I left a few suggestions

[mauri870]

I left a few minor comments, but the functionality looks good to me.

[blakerouse]

I believe this is possible directly with go-ucfg and doesn't require you to write a custom function to determine if its enabled or not. You could do something like this below and I think it would work.

func (t *takeOverConfig) Unpack(value interface{}) error {
   // handle boolean value

   // handle object value
}

Then in the configuration you just use TakeOver takeOverConfig config:"take_over". When reading the configuration is done, it will call Unpack and you can handle both cases.

[colleenmcginnis]

Some thoughts and suggestions below. Let me know if you have questions about the versioning piece.

[blakerouse]

Looks good. Thank you for switching to using the Unpack interface. Nice idea with the LogWarnings.

[karenzone]

LGTM