anchor.diff:        "paths": [
           "/var/log/*.log"
         ],
  -      "fields": { "type": "syslog" }
  +      "fields": {
  +        "type": "syslog",
  +        "service": "test01"
  +      }
       }
     ],
     "network": {
  
positive.code:       ],
  
        # A dictionary of fields to annotate on each event.
        "fields": { "type": "syslog" }
      }, {
        # A path of "-" means stdin.
        "paths": [ "-" ],
  
negative.code: |===
  
  
  === Changes in the output fields
  
  In the default configuration, Filebeat structures its output documents a little
  different from the Logstash Forwarder. This section discusses the differences
  and the options you have in case you want compatibility with the Logstash
  Forwarder.
  
  One such difference is that the custom fields (added from the configuration
  file) are set top level in Logstash Forwarder but are grouped together under a
  `fields` dictionary in Filebeat. If you need the old behavior during the
  migration phase, you can use the <<fields-under-root>> configuration option:
  
  [source,yaml]
  -------------------------------------------------------------------------------------
  filebeat:
    prospectors:
      -
        paths:
          - "/var/log/*.log"
        document_type: syslog
        fields:
          service: test01
        fields_under_root: true
  -------------------------------------------------------------------------------------
  
  Another difference is that while the Logstash Forwarder sends the hostname of
  the server it is running on in the `host` field, Filebeat uses the
  `beat.hostname` field for the same purpose. Because `host` is commonly used in
  the Logstash plugin ecosystem, the Beats input plugin automatically copies
  `beat.hostname` into `host`.
  
  Similarly, the `file` field was renamed to `source`. If you rely on this field
  being named `file` you can rename it by using the mutate filter in Logstash. For
  example:
  
  [source,plain]
  -------------------------------------------------------------------------------------
  filter {
      mutate {
          rename => {
              "source" => "file"
          }
      }
  }
  -------------------------------------------------------------------------------------
  
  Finally, the `line` field was removed. This field wasn't correct in case of
  restarts and making it correct would require a performance penalty. We recommend
  using the `offset` field instead.
  
  === Other Changes
  
  The following list of implementation changes should not affect your experience migrating
  