anchor.diff:   * `@timestamp`. Set this to the timestamp of the first packet from the message
      and cast it to `common.Time` like in the example.
    * `type`. Set this to the protocol name.
  - * `count`. This is reserved for future sampling support. Set it to 1.
    * `status`. The status of the transactions. Use either `common.OK_STATUS` or
      `common.ERROR_STATUS`. If the protocol doesn't have responses or a meaning of
      status code, use OK.
  - * `path`. This should represent what is requested, with the exact meaning
  + * `resource`. This should represent what is requested, with the exact meaning
      depending on the protocol. For HTTP, this is the URL.  For SQL databases,
      this is the table name. For key-value stores, this is the key. If nothing
      seems to make sense to put in this field, use the empty string.
  
positive.code: files as input and checking the results in the files created by using the "file"
  output plugin.
  
  This is the approach taken by the tests in the
  https://github.com/elastic/beats/tree/master/packetbeat/tests/system[`tests/system`] directory. The
  tests are written in Python and executed using
  https://nose.readthedocs.org/en/latest/[nose]. Here is a simple example test
  from the MongoDB suite:
  
negative.code: <3> Call the interface functions exported by the module. The `private` structure
  is passed from one call to the next like the TCP layer would do.
  
  <4> The `expectTransaction` function tries to read from the publisher queue and
  causes errors in the test case if there's no transaction present.
  
  To check the coverage of your unit tests, run the `make cover` command at the
  top of the repository.
  