anchor.diff:   * `@timestamp`. Set this to the timestamp of the first packet from the message
      and cast it to `common.Time` like in the example.
    * `type`. Set this to the protocol name.
  - * `count`. This is reserved for future sampling support. Set it to 1.
    * `status`. The status of the transactions. Use either `common.OK_STATUS` or
      `common.ERROR_STATUS`. If the protocol doesn't have responses or a meaning of
      status code, use OK.
  - * `path`. This should represent what is requested, with the exact meaning
  + * `resource`. This should represent what is requested, with the exact meaning
      depending on the protocol. For HTTP, this is the URL.  For SQL databases,
      this is the table name. For key-value stores, this is the key. If nothing
      seems to make sense to put in this field, use the empty string.
  
positive.code: the other direction.
  
  The `private` parameter can be used by the module to store state in the TCP stream.
  The module would typically cast this at runtime to a
  type of its choice, modify it as needed, and then return the modified value.
  The next time the TCP layer calls `Parse()` or another function from the
  `TcpProtocolPlugin` interface, it will call the function with the modified
  
negative.code: 
  The stream buffer also implements a number of interfaces defined in the standard "io" package
  and can easily be used to serialize some packets for testing parsers (see
  `beats/packetbeat/protos/memcache/binary_test.go`).
  
  ===== Module Helpers
  
  Packetbeat provides the module `beats/packetbeat/protos/applayer` with
  common definitions among all application layer protocols. For example using the
  Transaction type from `applayer` guarantees that the final document will have all common required fields defined. Just embed the `applayer.Transaction` with your own
  application layer transaction type to make use of it. Here is an example from the memcache protocol:
  