anchor.diff:          "time": {  <1>
             "max": {"field": "time"}
           },
  -        "airline": {  <1>
  +        "airline": {  <2>
             "terms": {
               "field": "airline",
               "size": 100
             },
             "aggregations": {
  -            "responsetime": {  <1>
  +            "responsetime": {  <3>
                 "avg": {
                   "field": "responsetime"
                 }
  
positive.code: finer, more granular time buckets, which are ideal for this type of analysis. If
  your detectors use <<ml-count-functions,count>> or <<ml-rare-functions,rare>>
  functions, set the interval to the same value as the bucket span.
  
  When you create or update an {anomaly-job}, you can include the names of
  aggregations, for example:
  
negative.code: 
  <1> In this example, the aggregations have names that match the fields that they
  operate on. That is to say, the `max` aggregation is named `time` and its
  field also needs to be `time`.
  <2> Likewise, the `term` aggregation is named `airline` and its field is also 
  named `airline`.
  <3> Likewise, the `avg` aggregation is named `responsetime` and its field is 
  also named `responsetime`.
  
  Your {dfeed} can contain multiple aggregations, but only the ones with names 
  that match values in the job configuration are fed to the job.
  
  
  [discrete]
  [[aggs-dfeeds]]
  ==== Nested aggregations in {dfeeds}
  
  {dfeeds-cap} support complex nested aggregations. This example uses the 
  `derivative` pipeline aggregation to find the first order derivative of the 
  counter `system.network.out.bytes` for each value of the field `beat.name`.
  
  [source,js]
  ----------------------------------
  