anchor.diff:  
   [source,shell]
   ------------------------------------------------------------
  -packetbeat -e -c /etc/packetbeat/packetbeat.yml -d "publish"
  +packetbeat -e -d "publish"
   ------------------------------------------------------------
   
   You can enable multiple debug selectors by separating them with comas. For
  
positive.code: packetbeat -e -c /etc/packetbeat/packetbeat.conf -d "publish,mysql,mysqldetailed"
  ---------------------------------------------------------------------------------
  
  Here is the list of all available debug selectors:
  
  * http
  * httpdetailed
  
negative.code: * thrift
  * thriftdetailed
  
  If you want all the debugging output (fair warning, it is quite a lot), you can
  use `*`, like this:
  
  [source,shell]
  ------------------------------------------------------------
  packetbeat -e -d "*"
  ------------------------------------------------------------
  
  === Recording a trace
  
  If you are having an issue, it is often useful to record a full network trace
  and send it to us. It will help us reproduce the issue and we can also add it
  to our automatic regression tests so that the problem never reoccurs. A trace
  of 10-20 seconds is usually enough. To record it, you can use Packetbeat itself
  like this:
  
  [source,shell]
  ------------------------------------------------------------
  packetbeat -e -dump trace.pcap
  ------------------------------------------------------------
  
  This executes Packetbeat in normal mode (all processing happens as usual) but
  at the same time records all packets in libpcap format in the `trace.pcap`
  file. If there's a particular error message you want us to investigate, please
  keep the trace running until the error shows up (it will printed on standard
  error).
  
  WARNING: PCAP files can be large. Please monitor the disk usage while doing the
  dump to make sure you don't run out of disk space. Whenever possible, we
  recommend doing this on a non-production machine.
  