anchor.diff:  Make sure to replace `localhost:9200` with the address of your Elasticsearch
   instance. It should return data about the HTTP transaction you just created.
   
  +==== Command Line Options
  +
  +[source,shell]
  +------------------------------------------------------------------------
  +$ ./packetbeat -h
  +Usage of ./packetbeat:
  +  -I string
  +    	file
  +  -N	Disable actual publishing for testing
  +  -O	Read packets one at a time (press Enter)
  +  -c string
  +    	Configuration file (default "/etc/packetbeat/packetbeat.yml")
  +  -cpuprofile string
  +    	Write cpu profile to file
  +  -d string
  +    	Enable certain debug selectors
  +  -devices
  +    	Print the list of devices and exit
  +  -dump string
  +    	Write all captured packets to this libpcap file
  +  -e	Output to stdout and disable syslog/file output
  +  -l int
  +    	Loop file. 0 - loop forever (default 1)
  +  -memprofile string
  +    	Write memory profile to this file
  +  -t	Read packets as fast as possible, without sleeping
  +  -test
  +    	Test configuration and exit.
  +  -v	Log at INFO level
  +  -version
  +    	Print version and exit
  +  -waitstop int
  +    	Additional seconds to wait befor shutting down
  +----------------------------------------------------------------------------
  +
  +===== -I
  +Instead of reading packets from the network, you can pass a `PCAP` file as input to Packetbeat. 
  +This option is used only for testing Packetbeat. Example: `-I ~/pcaps/network_traffic.pcap`.
  +
  +===== -N
  +Disable publishing the events to the defined output. This option is used only for testing Packetbeat.
  +
  +===== -O
  +Read a packet one by one by pressing _Enter_ after each. This option is used only for testing Packetbeat.
  +
  +===== -devices
  +Print the list of devices. This option is used only for testing Packetbeat.
  +
  +===== -dump
  +Write all captured packets to a file. This option is used only for testing Packetbeat.
  +
  +===== -l
  +This option needs to be used in combination with the _pcap file input (-I)_ in order to define how many times to read
  +the pcap file. For a infinite loop, use _0_. This option is used only for testing Packetbeat.
  +
  +===== -t
  +This option needs to be used in combination with the _pcap file input (-I)_. If present, reads the packets from the pcap
  +file as fast as possible, without sleeping. This option is used only for testing Packetbeat.
  +
  +===== -waitstop
  +Additional seconds to wait before exiting.
  +
  +
  +For the other options, check {libbeat}/command-line-options.html[Beats Command Line Options].
  +
   Enjoy!
  
positive.code: 
  NOTE: We also provide 32bits images. You can get them from our
  https://www.elastic.co/downloads/beats/packetbeat[download page].
  
  Before starting the shipper, edit the configuration file. For rpm and deb the
  configuration file is `/etc/packetbeat/packetbeat.yml`. For mac the
  
negative.code:     #save_topology: false
  ----------------------------------------------------------------------
  
  
  [[packetbeat-template]]
  === Load index template in Elasticsearch
  
  Before starting Packetbeat, you need to load the
  http://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html[index
  template], which is used to let Elasticsearch know which fields should be analyzed
  