anchor.diff:        # Paths that should be crawled and fetched. Glob based paths.
         # For each file found under this path, a harvester is started.
         paths:
  +        - "/var/log/apache/httpd-*.log"
  +      # Type to be published in the 'type' field. For Elasticsearch output,
  +      # the type defines the document type these entries should be stored
  +      # in. Default: log
  +      document_type: apache
  +    -
  +      paths:
  +        - /var/log/messages
           - "/var/log/*.log"
  -      # - c:\programdata\elasticsearch\logs\*
  -
  -      # Type of the files. Based on this the way the file is read is decided.
  -      # The different types cannot be mixed in one prospector
  -      #
  -      # Possible options are:
  -      # * log: Reads every line of the log file (default)
  -      # * stdin: Reads the standard in
  -      input_type: log
  -
  -      # Optional additional fields. These field can be freely picked
  -      # to add additional information to the crawled log files for filtering
  -      #fields:
  -      #  level: debug
  -      #  review: 1
  -
  -      # Set to true to store the additional fields as top level fields instead
  -      # of under the "fields" sub-dictionary. In case of name conflicts with the
  -      # fields added by Filebeat itself, the custom fields overwrite the default
  -      # fields.
  -      #fields_under_root: false
  -
  -      # Ignore files which were modified more then the defined timespan in the past
  -      # Time strings like 2h (2 hours), 5m (5 minutes) can be used.
  -      #ignore_older:
  -
  -      # Scan frequency in seconds.
  -      # How often these files should be checked for changes. In case it is set
  -      # to 0s, it is done as often as possible. Default: 10s
  -      #scan_frequency: 10s
  -
  -      # Defines the buffer size every harvester uses when fetching the file
  -      #harvester_buffer_size: 16384
  -
  -      # Setting tail_files to true means filebeat starts readding new files at the end
  -      # instead of the beginning. If this is used in combination with log rotation
  -      # this can mean that the first entries of a new file are skipped.
  -      #tail_files: false
  -
  -      # Configure the file encoding for reading files with international characters
  -      # following the W3C recommendation for HTML5 (http://www.w3.org/TR/encoding).
  -      # Some sample encodings:
  -      #   plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk,
  -      #    hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ...
  -      #encoding: plain
  --------------------------------------------------------------------------------------
  +
  +-------------------------------------------------------------------------------------
  +
  +==== Options
   
   ===== paths
   
  -A list of glob based paths that should be crawled and fetched. For each file found under this path, a harvester is
  -started. Each path is defined one per line.
  +A list of glob-based paths that should be crawled and fetched. Filebeat starts a harvester for
  +each file that it finds under the specified paths. You can specify one path per line. Each line begins with a dash (-).
   
   ===== input_type
   
  -It has two options:
  -
  -    * log:  Reads every line of the log file (default)
  +One of the following input types:
  +
  +    * log: Reads every line of the log file (default)
       * stdin: Reads the standard in
   
  -The type value will be put into each event published to Logstash and
  -Elasticsearch in the 'input_type' field.
  +The value that you specify here is used as the `input_type` for each event published to Logstash and Elasticsearch.
   
   [[configuration-fields]]
   ===== fields
   
  -Add optionally couple of fields to be included to the exported fields by the currently configured
  -Filebeat instance. These fields can be freely picked to add additional information to the crawled
  -log files for filtering.
  +Optional fields that you can specify to add additional information to the output. For
  +example, you might add fields that you can use for filtering log data. By default,
  +the fields that you specify here will be grouped under a `fields` sub-dictionary in the output document. To store the custom fields as top-level fields, set the `fields_under_root` option to true.
   
   [source,yaml]
   -------------------------------------------------------------------------------------
  
positive.code: 
  ===== backoff
  
  Backoff values define how aggressively Filebeat crawls new files for updates
  The default values can be used in most cases. Backoff defines how long it is waited
  to check a file again after EOF is reached. Default is 1s which means the file
  is checked every second if new lines were added. This leads to a near real time crawling.
  Every time a new line appears, backoff is reset to the initial value.
  Default: 1s
  
  ===== max_backoff
  
  Max backoff defines what the maximum waiting time is. After having backed off multiple times
  from checking the files, the waiting time will never exceed max_backoff independent of the
  backoff factor. Having it set to 10s means in the worst case a new line can be added to a log
  file after having backed off multiple times, it takes a maximum of 10s to read the new line.
  Default: 10s
  
  ===== backoff_factor
  
  The backoff factor defines how fast the waiting time is increased. The bigger the backoff factor,
  the faster the max_backoff value is reached. The backoff increments exponential.
  The minimal value allowed is 1. If this value is set to 1 it means backoff algorithm is disabled
  and the backoff value is used for waiting for new lines.
  The backoff value will be multiplied each time with the backoff_factor until max_backoff is reached.
  Default: 2
  
  ===== partial_line_waiting
  
  Defines the time on how long the harvester will wait for a line to be completed.
  Sometimes a lines it not completely written when checked by Filebeat. Filebeat
  will wait for the time defined below so the system can complete the line.
  In case the line is not completed in this time, the line will be skipped.
  Default: 5s
  
  ===== force_close_files
  
  This option closes a file, as soon as the file name changes.
  This config option is recommended on windows only. Filebeat keeps the files it's reading open. This can cause
  issues when the file is removed, as the file will not be fully removed until also Filebeat closes
  the reading. Filebeat closes the file handler after ignore_older. During this time no new file with the
  same name can be created. Turning this feature on the other hand can lead to loss of data
  on rotate files. It can happen that after file rotation the beginning of the new
  file is skipped, as the reading starts at the end. We recommend to leave this option on false
  but lower the ignore_older value to release files faster.
  Default: false
  
  ===== spool_size
  
  Event count spool threshold - forces network flush if exceeded.
  
  -------------------------------------------------------------------------------------
  filebeat:
    spool_size: 1024
  
negative.code: [[filebeat-configuration-details]]
  == Configuration Options
  
  The Filebeat configuration file uses http://yaml.org/[YAML] for its syntax.
  The _etc/filebeat.yml_ file consists of the following sections:
  
  * {libbeat}/configuration.html#configuration-shipper[Shipper]
  * {libbeat}/configuration.html#configuration-output[Output]
  