anchor.diff:  
   ===== exclude_files
   
  -A list of regular expressions to match the files to be ignored. By default no file is excluded.
  +A list of regular expressions to match the files that you want Filebeat to ignore. By default no files are excluded.
  +
  +The following example configures Filebeat to ignore all the files that have a `gz` extension:
   
   [source,yaml]
   -------------------------------------------------------------------------------------
     exclude_files: [".gz$"]
   -------------------------------------------------------------------------------------
  -To ignore all the files with the `gz` extension.
   
   [[configuration-fields]]
   ===== fields
  
positive.code: 
  ===== config_dir
  
  The full Path to the directory that contains additional prospector configuration files.
  Each configuration file must end with `.yml`. Each config file must also specify the full Filebeat
  config hierarchy even though only the prospector part of the file is processed. All global
  options, such as `spool_size`, are ignored.
  
negative.code: 
  ===== max_bytes
  
  The maximum number of bytes that a single log event can have. All bytes after `max_bytes` are discarded and not sent.
  This setting is especially useful for multiline log messages, which can get large. The default is 10MB (10485760).
  
  ===== multiline
  
  Options that control how Filebeat deals with log messages that span multiple lines. Multiline messages are common in Java stack traces and C line continuation. 
  
  The following example shows how to configure Filebeat to handle a multiline message where the first line of the message begins with a bracket (`[`). 
  
  [source,yaml]
  -------------------------------------------------------------------------------------
  multiline:
      pattern: ^\[
      negate: true
      match: after
  
  -------------------------------------------------------------------------------------
  
  Filebeat takes all the lines that do not start with `[` and combines them with the previous line that does. You can use this configuration to handle a Java stack trace that contains multiline messages like:
  
  ["source","sh",subs="attributes,callouts"]
  -------------------------------------------------------------------------------------
  [beat-logstash-some-name-832-2015.11.28] IndexNotFoundException[no such index]
      at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver$WildcardExpressionResolver.resolve(IndexNameExpressionResolver.java:566)
      at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:133)
      at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:77)
      at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.java:75)
  -------------------------------------------------------------------------------------
  
  You specify the following settings under `multiline` to control how Filebeat combines the lines in the message:
  
  *`pattern`*:: Specifies the regular expression pattern to match. 
  
  *`negate`*:: Defines whether the pattern is negated. The default is `false`.
  
  *`match`*:: Specifies how Filebeat combines matching lines into an event. The settings are `after` or `before`. The behavior of these settings depends on what you specify for `negate`:
  +
  [options="header"]
  |=======================
  |Setting for `negate` | Setting for `match` | Result
  |`false`              | `after`             | Consecutive lines that match the pattern are appended to the previous line that doesn't match. 
  |`false`              | `before`            | Consecutive lines that match the pattern are prepended to the next line that doesn't match. 
  |`true`               | `after`             | Consecutive lines that don't match the pattern are appended to the previous line that does match. 
  |`true`               | `before`            | Consecutive lines that don't match that pattern are prepended to the next line that does match. 
  |=======================
  +
  NOTE: The `after` setting is equivalent to `previous` in https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html[Logstash], and `before` is equivalent to `next`.
  
  *`max_lines`*:: The maximum number of lines that can be combined into one event. If
  the multiline message contains more than `max_lines`, any additional
  lines are discarded. The default is 500.
  
  *`timeout`*:: After the specified timeout, Filebeat sends the multiline event even if no new pattern is found to start a new event. The default is 5s.
  
  
  ===== tail_files
  