anchor.diff:      "search": {
         "request": {
           "indices": [
  -          "<logstash-{now-1h}>", <1>
  -          "<logstash-{now}>"
  +          "logstash" <1>
           ],
           "body": {
             "size": 0,
  
positive.code:           "aggs": {
              "group_by_city": {
                "terms": {
                  "field": "group.group_city.raw", <3>
                  "size": 5
                },
                "aggs": {
                  "group_by_event": {
                    "terms": {
                      "field": "event.event_url.raw", <4>
                      "size": 5
                    },
                    "aggs": {
  
negative.code: --
  [source,js]
  --------------------------------------------------
  "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
  --------------------------------------------------
  // NOTCONSOLE
  --
  