anchor.diff:  ------------------------------------------------------------------------------
   output:
     elasticsearch:
  -    # Uncomment out this option if you want to output to Elasticsearch. The
  -    # default is false.
  +
  +    # Enable Elasticsearch as output
       enabled: true
   
  -    # Set the host and port where to find Elasticsearch.
  -    hosts: ["localhost:9200"]
  -
  -    # Optional protocol and basic auth credentials
  -    # protocol: "https"
  -    # username: "admin"
  -    # password: "s3cr3t"
  +    # The Elasticsearch cluster
  +    hosts: ["http://10.45.3.2", "http://10.45.3.1/elasticsearch"]
   
       # Comment this option if you don't want to store the topology in
       # Elasticsearch. The default is false.
  
positive.code:     # [packetbeat-]YYYY.MM.DD keys.
      index: "packetbeat"
  
      # Optional HTTP Path
      path: "/elasticsearch"
  
      # List of root certificates for HTTPS server verifications
      cas: ["/etc/pki/root/ca.pem"]
  
  
negative.code: The number of seconds to wait for new events between two bulk API index requests.
  If `bulk_max_size` is reached before this interval expires, addition bulk index
  requests are made.
  
  ===== save_topology
  
  