Merge pull request #2530 from dedemorton/misc_content_changes

Misc content changes

filebeat/docs/faq.asciidoc

@@ -88,6 +88,19 @@ config file. Setting `scan_frequency` to less than 1s may cause Filebeat to scan
 
 The index template might not be loaded correctly. See <<filebeat-template>>.
 
+[float]
+[[fields-not-indexed]]
+=== Fields are not indexed or usable in Kibana visualizations?
+
+If you have recently performed an operation that loads or parses custom, structured logs,
+you might need to refresh the index to make the fields available in Kibana. To refresh
+the index, use the {elasticsearch}/indices-refresh.html[refresh API]. For example:
+
+["source","sh"]
+----------------------------------------------------------------------
+curl -XPOST 'http://localhost:9200/filebeat-2016.08.09/_refresh'
+----------------------------------------------------------------------
+
 [float]
 [[newline-character-required-eof]]
 === Filebeat isn't shipping the last line of a file?

filebeat/docs/reference/configuration/filebeat-options.asciidoc

@@ -35,7 +35,9 @@ The value that you specify here is used as the `input_type` for each event publi
 
 ===== paths
 
-A list of glob-based paths that should be crawled and fetched. Filebeat starts a harvester for
+A list of glob-based paths that should be crawled and fetched. Filebeat supports all glob patterns that are supported by https://golang.org/pkg/path/filepath/#Glob[Golang Glob].
+
+Filebeat starts a harvester for
 each file that it finds under the specified paths. You can specify one path per line. Each line begins with a dash (-).
 
 ===== encoding

libbeat/docs/shared-command-line.asciidoc

@@ -9,6 +9,14 @@
 //// include::../../libbeat/docs/shared-command-line.asciidoc[]
 //////////////////////////////////////////////////////////////////////////
 
+*`-E <setting>=<value>`*::
+Overwrite an individual setting in the config file. For example:
++
+["source","sh"]
+----------------------------------------------------------------------
+sudo ./packetbeat -c packetbeat.yml -E name=mybeat
+----------------------------------------------------------------------
+
 *`-N`*::
 Disable the publishing of events to the defined output. This option is useful only
 for testing the Beat.

libbeat/docs/shared-ssl-logstash-config.asciidoc

@@ -18,18 +18,12 @@ To use SSL mutual authentication:
 . Create a certificate authority (CA) and use it to sign the certificates that you plan to use for
 {beatname_uc} and Logstash. Creating a correct SSL/TLS infrastructure is outside the scope of this
 document. There are many online resources available that describe how to create certificates, including the section in the {security} documentation about {securitydoc}/certificate-authority.html[setting up a certificate authority].
-+
-NOTE: Certificates must be signed by your root CA. Intermediate CAs are currently not supported.
 
 . Configure {beatname_uc} to use SSL. In the +{beatname_lc}.yml+ config file, specify the following settings under
 `ssl`:
 +
 * `certificate_authorities`: Configures {beatname_uc} to trust any certificates signed by the specified CA. If
 `certificate_authorities` is empty or not set, the trusted certificate authorities of the host system are used.
-+
-Although  intermediate CAs are currently not supported, you may be able to work around this issue by merging all the
-certificates in the chain into one file. You can create the PEM file containing the CA chain by concatenating the root CA
-cert and the intermediate CA into a single file: `cat root-ca.crt intermediate-ca.crt > chain.crt`. Then set `certificate_authorities` to use this file: `certificate_authorities: ['chain.crt']`.
 
 * `certificate` and `key`: Specifies the certificate and key that {beatname_uc} uses to authenticate with
 Logstash.
@@ -73,7 +67,7 @@ input {
 ------------------------------------------------------------------------------
 +
 For more information about these options, see the
-https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html[documentation] for the Beats input plugin.
+https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html[documentation for the Beats input plugin].
 
 [float]
 [[testing-ssl-logstash]]

winlogbeat/docs/fields.asciidoc

@@ -114,7 +114,7 @@ type: dict
 
 required: False
 
-The event specific data. This field is mutually exclusive with `user_data`.
+The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. 
 
 
 [float]

winlogbeat/etc/fields.yml

@@ -42,8 +42,11 @@
       dict-type: keyword
       required: false
       description: >
-        The event specific data. This field is mutually exclusive with
-        `user_data`.
+        The event-specific data. This field is mutually exclusive with
+        `user_data`. If you are capturing event data on versions prior
+        to Windows Vista, the parameters in `event_data` are named `param1`,
+        `param2`, and so on, because event log parameters are unnamed in
+        earlier versions of Windows. 
 
     - name: event_id
       type: long