anchor.diff:  
       elasticsearch = {
         enable = true;
  +      extraConf = ''
  +        cluster.max_shards_per_node: 100000
  +        node.name: "elasticsearch"
  +        node.master: true
  +        node.data: true
  +      '';
         package = pkgs.elasticsearch7-oss;
       };
   
  
positive.code: 
        filterConfig = ''
          if [@metadata][beat] {
            mutate { add_field => { "type" => "%{[@metadata][beat]}" } }
          }
        '';
  
negative.code:       permitRootLogin = "no";
      };
  
      packetbeat = {
        enable = true;
        package = pkgs.packetbeat7;
  
        protocols = {
          dhcpv4.enable = true;
          dns.enable = true;
        };
  #
  #      extraConfig = ''
  #        packetbeat.flows:
  