anchor.diff:    topology_expire: 15
   ------------------------------------------------------------------------------
   
  -
  -==== Name
  +==== Options
  +
  +===== name
   
   The name of the Packetbeat agent. If empty, the `hostname` of the server is
   used. This information is included in each transaction (the `agent` field)
  
positive.code:       in promiscuous mode.
  
  
  ==== Snaplen
  
  The *snaplen* option controls the maximum size of the packets to capture. You
  generally want to set this to the MTU size used in your network. If the
  capturing *device* is "any" or "lo", the default value of this parameter is
  16436. Otherwise, it is 1514.
  
  [source,yaml]
  
negative.code:  - Agent2: t1
   - Agent3: t2
  
  ===== refresh_topology_freq
  
  This setting settings controls the refreshing interval of the topology map in
  seconds. In other words, how often each agent publishes its IP addresses to the
  topology map. The default is 10 seconds.
  
  ===== topology_expire
  
  This setting controls the expiration time for the topology in seconds. This is
  useful in case an agent stops publishing its IP addresses.  The IP addresses
  are removed automatically from the topology map after expiration. The default
  is 15 seconds.
  
  
  [[configuration-interfaces]]
  === Interfaces
  
  The `interfaces` section configures the sniffer. Here is a sample
  configuration:
  
  [source,yaml]
  ------------------------------------------------------------------------------
  # Select the network interfaces to sniff the data. You can use the "any"
  # keyword to sniff on all connected interfaces.
  interfaces:
    # On which devices to sniff
    device: any
  
    # The maximum capture size of a single packet.
    snaplen: 1514
  
    # The type of the sniffer to use
    type: af_packet
  
    # The size of the sniffing buffer
    buffer_size_mb: 100
  ------------------------------------------------------------------------------
  
  ==== Options
  
  ===== device
  
  Configures the network devices from which the traffic is
  captured. The configured device is set automatically in promiscuous mode,
  