anchor.diff:    (Optional, unsigned integer) The `size` parameter that is used in {es}
     searches. The default value is `1000`.
   
  -For more information about these properties,
  -see <<ml-datafeed-resource>>.
  +For more information about these properties, see <<ml-datafeed-resource>>.
  +
   
   [[ml-update-datafeed-example]]
   ==== {api-examples-title}
  
positive.code: cluster privileges to use this API. See
  {stack-ov}/security-privileges.html[Security privileges].
  
  [[ml-update-datafeed-desc]]
  ==== {api-description-title}
  
  If you update the `delayed_data_check_config` property, you must stop and
  start the {dfeed} for the change to be applied.
  
  IMPORTANT: When {es} {security-features} are enabled, your {dfeed} remembers
  which roles the user who updated it had at the time of update and runs the query
  
negative.code:   (Optional, array) An array of index names. Wildcards are supported. For
    example: `["it_ops_metrics", "server*"]`.
  
  `query`::
    (Optional, object) The {es} query domain-specific language (DSL). This value
    corresponds to the query object in an {es} search POST body. All the options
    that are supported by {es} can be used, as this object is passed verbatim to
    {es}. By default, this property has the following value:
    `{"match_all": {"boost": 1}}`.
  +
  --
  WARNING: If you change the query, then the analyzed data will also be changed, 
  therefore the required time to learn might be long and the understandability of 
  the results is unpredictable.
  If you want to make significant changes to the source data, we would recommend 
  you clone it and create a second job containing the amendments. Let both run in 
  parallel and close one when you are satisfied with the results of the other job.
  --
  
  `query_delay`::
    (Optional, <<time-units, time units>>) The number of seconds behind real-time 
  