anchor.diff:  
   ===== max_bytes
   
  -Maximum number of bytes a single log event can have. All bytes after max_bytes are discarded and not sent.
  -This is especially useful for multiline log messages which can get large. The default is 10MB (10485760).
  +The maximum number of bytes that a single log event can have. All bytes after `max_bytes` are discarded and not sent.
  +This setting is especially useful for multiline log messages, which can get large. The default is 10MB (10485760).
   
   ===== multiline
   
  -Mutiline can be used for log messages spanning multiple lines. This is common for Java Stack Traces
  -or C-Line Continuation. The following example combines all lines following a line start with a `[`.
  -This could for example be a Java Stack Trace.
  +Options that control how Filebeat deals with log messages that span multiple lines. Multiline messages are common in Java stack traces and C line continuation. 
  +
  +The following example shows how to configure Filebeat to handle a multiline message where the first line of the message begins with a bracket (`[`). 
   
   [source,yaml]
   -------------------------------------------------------------------------------------
   multiline:
       pattern: ^\[
  +    negate: true
       match: after
  -    negate: true
  --------------------------------------------------------------------------------------
  -
  -====== pattern
  -
  -The regexp pattern that has to be matched. The example pattern matches all lines starting with [
  -
  -====== negate
  -
  -Defines if the pattern set under pattern should be negated or not. Default is false.
  -
  -====== match
  -
  -Match must be set to "after" or "before". It is used to define if lines should be
  -appended to a pattern that was (not) matched before or after or as long as a
  -pattern is not matched based on negate.
  -
  -NOTE: After is the equivalent to previous and before is the equivalent to to next in https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html[Logstash].
  -
  -====== max_lines
  -
  -The maximum number of lines that are combined to one event. In case there are more the max_lines the additional
  -lines are discarded. Default is set to 500.
  -
  -====== timeout
  -
  -After the defined timeout, an multiline event is sent even if no new pattern was found to start a new event.
  -Default is set to 5s.
  +
  +-------------------------------------------------------------------------------------
  +
  +Filebeat takes all the lines that do not start with `[` and combines them with the previous line that does. You can use this configuration to handle a Java stack trace that contains multiline messages like:
  +
  +["source","sh",subs="attributes,callouts"]
  +-------------------------------------------------------------------------------------
  +[beat-logstash-some-name-832-2015.11.28] IndexNotFoundException[no such index]
  +    at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver$WildcardExpressionResolver.resolve(IndexNameExpressionResolver.java:566)
  +    at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:133)
  +    at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:77)
  +    at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.java:75)
  +-------------------------------------------------------------------------------------
  +
  +You specify the following settings under `multiline` to control how Filebeat combines the lines in the message:
  +
  +*`pattern`*:: Specifies the regular expression pattern to match. 
  +
  +*`negate`*:: Defines whether the pattern is negated. The default is `false`.
  +
  +*`match`*:: Specifies how Filebeat combines matching lines into an event. The settings are `after` or `before`. The behavior of these settings depends on what you specify for `negate`:
  ++
  +[options="header"]
  +|=======================
  +|Setting for `negate` | Setting for `match` | Result
  +|`false`              | `after`             | Consecutive lines that match the pattern are appended to the previous line that doesn't match. 
  +|`false`              | `before`            | Consecutive lines that match the pattern are prepended to the next line that doesn't match. 
  +|`true`               | `after`             | Consecutive lines that don't match the pattern are appended to the previous line that does match. 
  +|`true`               | `before`            | Consecutive lines that don't match that pattern are prepended to the next line that does match. 
  +|=======================
  ++
  +NOTE: The `after` setting is equivalent to `previous` in https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html[Logstash], and `before` is equivalent to `next`.
  +
  +*`max_lines`*:: The maximum number of lines that can be combined into one event. If
  +the multiline message contains more than `max_lines`, any additional
  +lines are discarded. The default is 500.
  +
  +*`timeout`*:: After the specified timeout, Filebeat sends the multiline event even if no new pattern is found to start a new event. The default is 5s.
   
   
   ===== tail_files
  
positive.code: 
  ===== config_dir
  
  The full Path to the directory that contains additional prospector configuration files.
  Each configuration file must end with `.yml`. Each config file must also specify the full Filebeat
  config hierarchy even though only the prospector part of the file is processed. All global
  options, such as `spool_size`, are ignored.
  
negative.code: 
  ===== exclude_lines
  
  A list of regular expressions to match the lines that you want Filebeat to exclude. Filebeat drops any lines that match a regular expression in the list. By default, no lines are dropped.
  
  The following example configures Filebeat to drop any lines that start with "DBG".
  
  [source,yaml]
  -------------------------------------------------------------------------------------
  exclude_lines: ["^DBG"]
  -------------------------------------------------------------------------------------
  
  ===== include_lines
  
  A list of regular expressions to match the lines that you want Filebeat to include. Filebeat exports only the lines that match a regular expression in the list. By default, all lines are exported.
  
  The following example configures Filebeat to export any lines that start with "ERR" or "WARN":
  
  [source,yaml]
  -------------------------------------------------------------------------------------
  include_lines: ["^ERR", "^WARN"]
  -------------------------------------------------------------------------------------
  
  NOTE: If both `include_lines` and `exclude_lines` are defined, `include_lines` is called first. So, for example, to export all Apache log lines except the debugging messages (DBGs), you can use:
  
  [source,yaml]
  -------------------------------------------------------------------------------------
  