anchor.diff:  
   ===== hide_keywords
   
  -Packetbeat has the option of automatically censor certain strings
  -from the transactions it saves. This is done because while the SQL traffic
  -typically only contains the hashes of the passwords, it is possible that the
  -HTTP traffic contains sensitive data. In order to reduce the security risks, 
  -Packetbeat can automatically avoid sending the contents of certain HTTP POST
  -parameters. The sensitive content associated with these keywords is replaced
  -by ``xxxxx``. By default, no changes are made to the HTTP messages.
  -
  -WARNING: This option replaces query parameters from GET requests and top level
  -parameters from POST requests. If the sensitive data is encoded inside a
  -parameter with a different name, we cannot censor it there. Also, note that if
  -you enable saving the raw request and response fields (see the `send_requset`
  -and the `send_response` options), the sensitive data will be present in those
  +A list of query parameters that Packetbeat will automatically censor in 
  +the transactions that it saves. The values associated with these parameters are replaced
  +by `'xxxxx'`. By default, no changes are made to the HTTP messages.
  +
  +Packbeat has this option because, unlike SQL traffic, which typically only contains the 
  +hashes of the passwords, HTTP traffic may contain sensitive data. To reduce security risks, 
  +you can configure this option to avoid sending the contents of certain HTTP POST 
  +parameters.
  +
  +WARNING: This option replaces query parameters from GET requests and top-level
  +parameters from POST requests. If sensitive data is encoded inside a
  +parameter that you don't specify here, Packetbeat cannot censor it. Also, note that if
  +you configure Packetbeat to save the raw request and response fields (see the <<send-request-option>>
  +and the <<send-response-option>> options), the sensitive data will be present in those
   fields.
   
  +
   ===== redact_authorization
   
  -If the transactions that are being observed use Basic Authentication
  -then the exchange contains the base64 unencrypted username and
  -password.  Enabling `redact_authorization` obscures the value of the
  +When this option is enabled, Packetbeat obscures the value of 
   `Authorization` and `Proxy-Authorization` HTTP headers, and censors
   those strings in the response.
   
  +You should set this option to true for transactions that use Basic Authentication because 
  +they may contain the base64 unencrypted username and password. 
  +
   ===== send_headers
   
  -A list of header names to be captured and send to Elasticsearch. These
  +A list of header names to capture and send to Elasticsearch. These
   headers are placed under the `headers` dictionary in the resulting JSON.
   
   ===== send_all_headers
   
  -Alternatively to sending a white list of headers to Elasticsearch, you can
  +Instead of sending a white list of headers to Elasticsearch, you can
   send all headers by setting this option to true. The default is false.
   
   ===== include_body_for
   
   The list of content types for which Packetbeat includes the full HTTP payload in
  -the `response` field. Should be used together with the `send_response` option.
  +the `response` field. This option should be used together with the <<send-response-option>> option.
   
   Example configuration:
   
  
positive.code:   device: eth0
  ------------------------------------------------------------------------------
  
  Alternatively, on Linux Packetbeat supports capturing of all
  messages sent or received by the server on which it is installed. For this, use
  the special "any" device.
  
  NOTE: When using the "any" device, the interfaces are not set
        in promiscuous mode.
  
  This option also accepts specifying the device by its index in the list of
  devices available for sniffing. To obtain the list of available devices, you can
  use run Packetbeat like this: `packetbeat -devices`. This is especially useful
  on Windows where device names are long. The following example will setup
  sniffing on the first interface available:
  
  [source,yaml]
  ------------------------------------------------------------------------------
  
negative.code: [[packetbeat-configuration]]
  == Configuration Options
  
  The Packetbeat configuration file uses http://yaml.org/[YAML] for its syntax. 
  The file consists of the following sections:
  
  
  * {libbeat}/configuration.html#configuration-shipper[Shipper]
  * <<configuration-interfaces>>
  * <<configuration-protocols>>
  * <<configuration-processes>>
  * {libbeat}/configuration.html#configuration-output[Output] 
  * {libbeat}/configuration.html#configuration-run-options[Run Options (Optional)]
  
  The `shipper`, `output`, and `runoptions` sections contain configuration options that are common to all 
  Beats, so they are covered in the {libbeat}/configuration.html[Beats Platform Reference].
  
  NOTE: Packetbeat maintains a real-time topology map of all the servers in your network. 
  See <<maintaining-topology>> for more details.
  
  [[configuration-interfaces]]
  === Interfaces
  
  The `interfaces` section configures the sniffer. Here is an example configuration:
  
  [source,yaml]
  ------------------------------------------------------------------------------
  