anchor.diff:  
   ===== max_docs
   
  -Maximum number of docs from the response to index in the `response` field. The
  +The maximum number of documents from the response to index in the `response` field. The
   default is 10. You can set this to 0 to index an unlimited number of documents.
   
  -A `[...]` line is added automatically at the end to signify that there were
  -more documents but they weren't saved because of this setting.
  +Packetbeat adds a `[...]` line at the end to signify that there were additional documents 
  +that weren't saved because of this setting.
   
   ===== max_doc_length
   
  -Maximum number of characters in a single document indexed in the `response`
  +The maximum number of characters in a single document indexed in the `response`
   field. The default is 5000. You can set this to 0 to index an unlimited number
   of characters per document.
   
  -If the document is trimmed because of this setting, the string ` ...` is added
  -at the end of it.
  -
  -Note that limiting documents this way means that they are no longer correctly
  +If the document is trimmed because of this setting, Packetbeat adds the string ` ...` 
  +at the end of the document.
  +
  +Note that limiting documents in this way means that they are no longer correctly
   formatted JSON objects.
   
  -
   [[maintaining-topology]]
  -=== Maintaining the Real-time State of the Network Topology
  -
  -One of the important features of Packetbeat is that it knows for each
  -transaction which is the source server and is the destination server by names.
  -It does this without the requirement of maintaining a central configuration.
  -Instead each Beat notes the hostname of the server on which it runs, and
  -maps that to the list of IP addresses of that server. This information is
  -shared between Beats by using the mechanisms provided by the output plugins.
  -
  -For example, the Redis output plugin stores the topology in a dedicated Redis
  -database and the Elasticsearch output plugin stores the topology in an
  -Elasticsearch index.
  -
  -While multiple output plugins can be enabled at the same time, only one of them
  -can be used for sharing the topology. If you have both Redis and Elasticsearch
  -enabled as outputs, we suggest using Redis for saving the topology. This can be
  -controlled from the `save_topology` configuration option.
  -
  -
  +=== Maintaining the Real-Time State of the Network Topology
  +
  +One important feature of Packetbeat is that it knows the name of the source and 
  +destination servers for each transaction. It does this without needing to maintain 
  +a central configuration. Instead, each Beat notes the hostname of the server 
  +where the Beat runs, and maps the hostname to the list of IP addresses of that server.
  +
  +Packetbeat stores the topology information in an Elasticsearch index, so to save 
  +the network topology, you need to use Elasticsearch as output and set the 
  +`save_topology` configuration option to true. 
   
   [[configuration-processes]]
  -=== Processes (optional)
  +=== Processes (Optional)
   
   This section is optional, but configuring the processes enables Packetbeat 
  -to not only show you between which servers the traffic is flowing, but
  -also between which processes. It can even show you the traffic between two
  -processes running on the same host, so this is particularly useful when you
  -have more services running on the same server. By default, process matching
  +to show you not only the servers that the traffic is flowing between, but
  +also the processes. Packetbeat can even show you the traffic between two
  +processes running on the same host, which is particularly useful when you
  +have many services running on the same server. By default, process matching
   is disabled.
   
  -When it starts (and then periodically) Packetbeat scans the process table for
  -processes matching the configuration file. For each of these processes, it
  +When Packetbeat starts, and then periodically afterwards, it scans the process table for
  +processes that match the configuration file. For each of these processes, it
   monitors which file descriptors it has opened. When a new packet is captured,
   it reads the list of active TCP connections and matches the corresponding one
   with the list of file descriptors.
   
   On a Linux system, all this information is available via the `/proc`
  -filesystem, so Packetbeat doesn't need a kernel module.
  +file system, so Packetbeat doesn't need a kernel module.
   
   
   NOTE: Process monitoring is currently only supported on
         Linux systems. Packetbeat automatically disables
  -      it when it detects other operating systems.
  +      process monitoring when it detects other operating systems.
   
   Example configuration:
   
  
positive.code: }
  ------------------------------------------------------------------------------
  
  <1> Note that `set-cookie` is a map having the cookie names as keys.
  
  The default is false.
  
  ===== real_ip_header
  
  The header field to extract the real IP from. This is often useful when
  capturing behind a reverse proxy and still wanting to get the geo-location
  information. If this header is present and contains a valid IP addresses, the
  information is used for the `real_ip` and `client_location` indexed
  fields.
  
  ==== Memcache Configuration
  
  [source,yaml]
  ------------------------------------------------------------------------------
  
negative.code: 
  ===== hide_keywords
  
  A list of query parameters that Packetbeat will automatically censor in 
  the transactions that it saves. The values associated with these parameters are replaced
  by `'xxxxx'`. By default, no changes are made to the HTTP messages.
  
  Packbeat has this option because, unlike SQL traffic, which typically only contains the 
  hashes of the passwords, HTTP traffic may contain sensitive data. To reduce security risks, 
  you can configure this option to avoid sending the contents of certain HTTP POST 
  parameters.
  
  WARNING: This option replaces query parameters from GET requests and top-level
  parameters from POST requests. If sensitive data is encoded inside a
  parameter that you don't specify here, Packetbeat cannot censor it. Also, note that if
  you configure Packetbeat to save the raw request and response fields (see the <<send-request-option>>
  and the <<send-response-option>> options), the sensitive data will be present in those
  fields.
  
  
  ===== redact_authorization
  
  When this option is enabled, Packetbeat obscures the value of 
  `Authorization` and `Proxy-Authorization` HTTP headers, and censors
  those strings in the response.
  
  You should set this option to true for transactions that use Basic Authentication because 
  they may contain the base64 unencrypted username and password. 
  
  ===== send_headers
  
  A list of header names to capture and send to Elasticsearch. These
  headers are placed under the `headers` dictionary in the resulting JSON.
  
  ===== send_all_headers
  
  Instead of sending a white list of headers to Elasticsearch, you can
  send all headers by setting this option to true. The default is false.
  
  ===== include_body_for
  
  The list of content types for which Packetbeat includes the full HTTP payload in
  the `response` field. This option should be used together with the <<send-response-option>> option.
  
  Example configuration:
  
  