anchor.diff:        add_field => [ "@ingestor.stream_identity", "%{host}.%{file}" ]
         add_field => [ "@source.path", "%{file}" ]
         add_field => [ "@source.offset", "%{offset}" ]
  -      remove_field => [ "host", "file", "offset" ]
  +      remove_field => [ "host", "file", "offset", "_logstash_input" ]
       }
     }
   }
  
positive.code: }
  
  filter {
    if [@ingestor.type] == "lumberjack" {
  
      #Support multiline stack traces
      multiline {
  
negative.code: input {
    lumberjack {
      add_field => [ "_logstash_input", "lumberjack" ]
      host => "<%= ENV['APP_CONFIG_LUMBERJACK_HOST'] || '0.0.0.0'  %>"
      port => "<%= ENV['APP_CONFIG_LUMBERJACK_PORT'] || '5043'  %>"
      ssl_certificate => "<%= ENV['APP_DATA_DIR'] %>/lumberjack.crt"
  