anchor.diff:        the respective indices permission entry.
   
   The specified `query` expects the same format as if it was defined in the
  -search request and supports ELasticsearch's full {ref}/query-dsl.html[Query DSL].
  -
  -For example, the following role grants read access to all indices, but restricts
  -access to documents whose `department_id` equals `12`.
  +search request and supports the full {es} {ref}/query-dsl.html[Query DSL].
  +
  +For example, the following role grants read access only to the documents whose
  +`department_id` equals `12`:
   
   [source,js]
   --------------------------------------------------
  
positive.code: [[set-security-user-processor]]
  ===== Set Security User Ingest Processor
  
  If an index is being shared by many small users it makes sense put all these users into the same index as having a
  dedicated index or shard per user is too wasteful. In order to guarantee that a user only read its own documents it
  makes sense to set up document level security. In order to use document level security for this each document must have
  the username or role name associated with it, so that it can be queried by the document level security's role query.
  This is where the `set_security_user` ingest processor can help.
  
  NOTE: You need to make sure to use unique ids for each user that uses the same index, because document level security
        doesn't apply on write APIs and you can overwrite other users' documents. This ingest processor just adds
        properties of the current authenticated user to the documents being indexed.
  
  
  The `set_security_user` processor attaches user related details (`username`, `roles`, `email`, `full_name` and `metadata` )
  from the current authenticated user to the current document by pre-processed by ingest.
  
  So when indexing data with an ingest pipeline then user details get automatically attached with the document:
  
  [source,js]
  --------------------------------------------------
  
negative.code: }
  --------------------------------------------------
  
  This is where wildcard support shines. For example, use `customer.*` to enable
  only read access to the `customer` data:
  
  [source,js]
  --------------------------------------------------
  