anchor.diff:  The number of seconds to wait for new events between two bulk API index requests.
   If `bulk_max_size` is reached before this interval expires, addition bulk index
   requests are made.
  -
  -===== path
  -
  -An HTTP path prefix that is prepended to the HTTP API calls. This is useful for
  -the cases where Elasticsearch listens behind an HTTP reverse proxy that exports
  -the API under a custom prefix.
   
   ===== save_topology
   
  
positive.code: ------------------------------------------------------------------------------
  output:
    elasticsearch:
      # Uncomment out this option if you want to output to Elasticsearch. The
      # default is false.
      enabled: true
  
      # Set the host and port where to find Elasticsearch.
      hosts: ["localhost:9200"]
  
      # Optional protocol and basic auth credentials
      # protocol: "https"
      # username: "admin"
      # password: "s3cr3t"
  
      # Comment this option if you don't want to store the topology in
      # Elasticsearch. The default is false.
  
negative.code:     # [packetbeat-]YYYY.MM.DD keys.
      index: "packetbeat"
  
      # List of root certificates for HTTPS server verifications
      cas: ["/etc/pki/root/ca.pem"]
  
  