anchor.diff:      review: 1
   
   -------------------------------------------------------------------------------------
  -
  +[[fields-under-root]]
   ===== fields_under_root
   
  -If set to true, the custom <<configuration-fields>> are stored as top level into the output
  -document instead of being grouped under a `fields` sub-dictionary. In case of conflicts with
  -the fields names added by Filebeat, the custom fields overwrite the existing fields.
  +If this option is set to true, the custom <<configuration-fields>> are stored as top-level fields
  +in the output document instead of being grouped under a `fields` sub-dictionary.
  +If the custom field names conflict with other field names added by Filebeat, the custom fields overwrite the other fields.
   
   ===== ignore_older
   
  -If set, ignores the files which were modified more then the defined timespan in the past
  -Time strings like 2h (2 hours), 5m (5 minutes) can be used. Default is set to 10m.
  +If this option is specified, Filebeat
  +ignores any files that were modified before the specified timespan.
  +You can use time strings like 2h (2 hours) and 5m (5 minutes). The default is 10m.
  +
   
   ===== scan_frequency
   
  -Scan frequency specifies how often the prospector checks for new files in the
  +How often the prospector checks for new files in the
   paths that are specified for harvesting. For example, if you specify a glob like
   `/var/log/*`, the directory is scanned for files using the frequency specified by
  -scan_frequency. If you specify 0s, the directory is scanned as frequently as
  +`scan_frequency`. If you specify 0s, the directory is scanned as frequently as
   possible. We recommend that you do not specify 0. The default setting is 10s.
   
   ===== document_type
   
  -Defines the event its type value to be used for published lines read by
  -harvesters. The document_type will be used by Elasticsearch output as document
  -type. Default value is `log`.
  -
  +The event type to use for published lines read by harvesters. For Elasticsearch
  +output, the value that you specify here is used to set the `type` field in the output
  +document. The default value is `log`.
   
   ===== harvester_buffer_size
   
  -Defines the buffer size every harvester uses when fetching the file. By default is 16384.
  +The buffer size every harvester uses when fetching the file. The default is 16384.
   
   
   ===== tail_files
  
positive.code: [[filebeat-configuration-details]]
  == Configuration Options
  
  The configuration file of Filebeat uses http://yaml.org/[YAML] as any other Beat.
  To start with the configuration it is best to have a look at the default configuration. It is described in detail
  what each configuration option is for and how it can be used. Remove the items that are not needed for your setup.
  
  The _etc/filebeat.yml_ consists of the following sections:
  
  * {libbeat}/configuration.html#configuration-shipper[Shipper]
  * {libbeat}/configuration.html#configuration-output[Output]
  
negative.code: 
  ===== backoff
  
  The backoff options specify how aggressively Filebeat crawls new files for updates.
  You can use the default values in most cases.
  
  The `backoff` option defines how long Filebeat
  waits before checking a file again after EOF is reached. The default is 1s, which means
  the file is checked every second if new lines were added. This enables near real-time crawling. Every time a new line appears in the file, the `backoff` value is reset to the initial
  value. The default is 1s.
  
  ===== max_backoff
  
  The maximum time for Filebeat to wait before checking a file again after EOF is
  reached. After having backed off multiple times from checking the file, the wait time
  will never exceed `max_backoff` regardless of what is specified for  `backoff_factor`.
  Because it takes a maximum of 10s to read a new line, specifying 10s for `max_backoff` means that, at the worst, a new line could be added to the log file if Filebeat has
  backed off multiple times. The default is 10s.
  
  ===== backoff_factor
  
  This option specifies how fast the waiting time is increased. The bigger the
  backoff factor, the faster the `max_backoff` value is reached. The backoff factor
  increments exponentially. The minimum value allowed is 1. If this value is set to 1,
  the backoff algorithm is disabled, and the `backoff` value is used for waiting for new
  lines. The `backoff` value will be multiplied each time with the `backoff_factor` until
  `max_backoff` is reached. The default is 2.
  
  ===== partial_line_waiting
  
  Sometimes Filebeat checks a line before it's completely written. This option specifies
  how long the harvester waits for the system to complete a line before skipping that line. The default is 5s.
  
  ===== force_close_files
  
  By default, Filebeat keeps the files that it’s reading open until the timespan specified by `ignore_older` has elapsed. This behaviour can cause issues when a file is removed. Because the file isn't fully removed until Filebeat closes the file, no new file with the same name can be created during this time.
  
  You can force Filebeat to close the file as soon as the file name changes by setting the `force_close_windows_files` option to true. This option is supported on Windows only. The default is false.
  
  Turning on this option can lead to loss of data on rotated files. After file rotation, the beginning of the new file might be skipped because the reading starts at the end of the file. We recommend that you leave this option set to false, and instead specify a lower value for the `ignore_older` option to release files faster.
  
  ===== spool_size
  
  The event count spool threshold. This setting forces a network flush if the specified
  value is exceeded.
  
  [source,yaml]
  -------------------------------------------------------------------------------------
  filebeat:
    spool_size: 1024
  