anchor.diff:  
   [source,shell]
   ------------------------------------------------------------
  -packetbeat -e -c /etc/packetbeat/packetbeat.yml -d "publish"
  +packetbeat -e -d "publish"
   ------------------------------------------------------------
   
   You can enable multiple debug selectors by separating them with comas. For
  
positive.code: * thrift
  * thriftdetailed
  
  === Recording a trace
  
  If you are having an issue, it is often useful to record a full network trace
  and send it to us. It will help us reproduce the issue and we can also add it to our
  automatic regression tests so that the problem never reoccurs. A trace of
  10-20 seconds is usually enough. To record it, you would typically use
  `tcpdump` like this:
  
  [source,shell]
  ---------------------------------
  tcpdump -i any -s0 -w"trace.pcap"
  ---------------------------------
  
  If you want to record a single protocol, it is useful to filter
  the traffic by port numbers. For example, to record only mysql traffic:
  
  [source,shell]
  ---------------------------------------------
  tcpdump -i any -s0 -w"trace.pcap" "port 3306"
  ---------------------------------------------
  
  Please send the trace at mailto:info@packetbeat.com[info@packetbeat.com] and
  also indicate if it's ok to include the trace in our test suite (without making
  it public).
  
  
negative.code: packetbeat -e -c /etc/packetbeat/packetbeat.conf -d "publish,mysql,mysqldetailed"
  ---------------------------------------------------------------------------------
  
  Here is the list of commonly used debug selectors:
  
  * http
  * httpdetailed
  