anchor.diff:        # Paths that should be crawled and fetched. Glob based paths.
         # For each file found under this path, a harvester is started.
         paths:
  +        - "/var/log/apache/httpd-*.log"
  +      # Type to be published in the 'type' field. For Elasticsearch output,
  +      # the type defines the document type these entries should be stored
  +      # in. Default: log
  +      document_type: apache
  +    -
  +      paths:
  +        - /var/log/messages
           - "/var/log/*.log"
  -      # - c:\programdata\elasticsearch\logs\*
  -
  -      # Type of the files. Based on this the way the file is read is decided.
  -      # The different types cannot be mixed in one prospector
  -      #
  -      # Possible options are:
  -      # * log: Reads every line of the log file (default)
  -      # * stdin: Reads the standard in
  -      input_type: log
  -
  -      # Optional additional fields. These field can be freely picked
  -      # to add additional information to the crawled log files for filtering
  -      #fields:
  -      #  level: debug
  -      #  review: 1
  -
  -      # Set to true to store the additional fields as top level fields instead
  -      # of under the "fields" sub-dictionary. In case of name conflicts with the
  -      # fields added by Filebeat itself, the custom fields overwrite the default
  -      # fields.
  -      #fields_under_root: false
  -
  -      # Ignore files which were modified more then the defined timespan in the past
  -      # Time strings like 2h (2 hours), 5m (5 minutes) can be used.
  -      #ignore_older:
  -
  -      # Scan frequency in seconds.
  -      # How often these files should be checked for changes. In case it is set
  -      # to 0s, it is done as often as possible. Default: 10s
  -      #scan_frequency: 10s
  -
  -      # Defines the buffer size every harvester uses when fetching the file
  -      #harvester_buffer_size: 16384
  -
  -      # Setting tail_files to true means filebeat starts readding new files at the end
  -      # instead of the beginning. If this is used in combination with log rotation
  -      # this can mean that the first entries of a new file are skipped.
  -      #tail_files: false
  -
  -      # Configure the file encoding for reading files with international characters
  -      # following the W3C recommendation for HTML5 (http://www.w3.org/TR/encoding).
  -      # Some sample encodings:
  -      #   plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk,
  -      #    hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ...
  -      #encoding: plain
  --------------------------------------------------------------------------------------
  +
  +-------------------------------------------------------------------------------------
  +
  +==== Options
   
   ===== paths
   
  -A list of glob based paths that should be crawled and fetched. For each file found under this path, a harvester is
  -started. Each path is defined one per line.
  +A list of glob-based paths that should be crawled and fetched. Filebeat starts a harvester for
  +each file that it finds under the specified paths. You can specify one path per line. Each line begins with a dash (-).
   
   ===== input_type
   
  -It has two options:
  -
  -    * log:  Reads every line of the log file (default)
  +One of the following input types:
  +
  +    * log: Reads every line of the log file (default)
       * stdin: Reads the standard in
   
  -The type value will be put into each event published to Logstash and
  -Elasticsearch in the 'input_type' field.
  +The value that you specify here is used as the `input_type` for each event published to Logstash and Elasticsearch.
   
   [[configuration-fields]]
   ===== fields
   
  -Add optionally couple of fields to be included to the exported fields by the currently configured
  -Filebeat instance. These fields can be freely picked to add additional information to the crawled
  -log files for filtering.
  +Optional fields that you can specify to add additional information to the output. For
  +example, you might add fields that you can use for filtering log data. By default,
  +the fields that you specify here will be grouped under a `fields` sub-dictionary in the output document. To store the custom fields as top-level fields, set the `fields_under_root` option to true.
   
   [source,yaml]
   -------------------------------------------------------------------------------------
  
positive.code: 
  ===== config_dir
  
  Full Path to directory with additional prospector configuration files. Each file must end with .yml
  These config files must have the full Filebeat config hierarchy inside, but only
  the prospector part is processed. All global options like spool_size are ignored.
  The config_dir MUST point to a different directory then where the main Filebeat config file is in.
  
  [source,yaml]
  -------------------------------------------------------------------------------------
  
negative.code: 
  ===== backoff
  
  The backoff options specify how aggressively Filebeat crawls new files for updates.
  You can use the default values in most cases.
  
  The `backoff` option defines how long Filebeat
  waits before checking a file again after EOF is reached. The default is 1s, which means
  the file is checked every second if new lines were added. This enables near real-time crawling. Every time a new line appears in the file, the `backoff` value is reset to the initial
  value. The default is 1s.
  
  ===== max_backoff
  
  The maximum time for Filebeat to wait before checking a file again after EOF is
  reached. After having backed off multiple times from checking the file, the wait time
  will never exceed `max_backoff` regardless of what is specified for  `backoff_factor`.
  Because it takes a maximum of 10s to read a new line, specifying 10s for `max_backoff` means that, at the worst, a new line could be added to the log file if Filebeat has
  backed off multiple times. The default is 10s.
  
  ===== backoff_factor
  
  This option specifies how fast the waiting time is increased. The bigger the
  backoff factor, the faster the `max_backoff` value is reached. The backoff factor
  increments exponentially. The minimum value allowed is 1. If this value is set to 1,
  the backoff algorithm is disabled, and the `backoff` value is used for waiting for new
  lines. The `backoff` value will be multiplied each time with the `backoff_factor` until
  `max_backoff` is reached. The default is 2.
  
  ===== partial_line_waiting
  
  Sometimes Filebeat checks a line before it's completely written. This option specifies
  how long the harvester waits for the system to complete a line before skipping that line. The default is 5s.
  
  ===== force_close_files
  
  By default, Filebeat keeps the files that it’s reading open until the timespan specified by `ignore_older` has elapsed. This behaviour can cause issues when a file is removed. Because the file isn't fully removed until Filebeat closes the file, no new file with the same name can be created during this time.
  
  You can force Filebeat to close the file as soon as the file name changes by setting the `force_close_windows_files` option to true. This option is supported on Windows only. The default is false.
  
  Turning on this option can lead to loss of data on rotated files. After file rotation, the beginning of the new file might be skipped because the reading starts at the end of the file. We recommend that you leave this option set to false, and instead specify a lower value for the `ignore_older` option to release files faster.
  
  ===== spool_size
  
  The event count spool threshold. This setting forces a network flush if the specified
  value is exceeded.
  
  [source,yaml]
  -------------------------------------------------------------------------------------
  filebeat:
    spool_size: 1024
  