anchor.diff:        paths:
           - /var/log/messages
           - "/var/log/*.log"
  +      document_type: syslog <1>
  +      fields:
  +        service: example-service
       -
         paths:
           - "-"
  -      input_type: stdin <1>
  +      input_type: stdin <2>
         document_type: stdin
       -
         paths:
  
positive.code:       document_type: apache
  -------------------------------------------------------------------------------------
  
  <1> The explicit `input_type` field was introduced to differentiate between normal files and
      stdin. In the future, additional types might be supported.
  
  As you can see, apart from the new optional `document_type` field,
  the remaining options can be migrated mechanically. If no type is defined,
  the default is set to `log`. If Filebeat is used to index into Elasticsearch
  directly, the `document_type` determines the document type to use when indexing.
  
  The Filebeat configuration gives you more control over how each prospector behaves
  by allowing you to configure options that were previously global in Logstash Forwarder
  and set them separately for each prospector. See
  <<filebeat-configuration-details>>.
  
  ==== Migrating the "network" Section
  
  
negative.code:       "paths": [
          "/var/log/*.log"
        ],
        "fields": {
          "type": "syslog",
          "service": "test01"
        }
      }
    ],
    "network": {
  