anchor.diff:  [source,eql]
   ----
   sequence by user.name with maxspan=15m
  -  [ file where file.extension == "exe" ] by file.path
  -  [ process where true ] by process.executable
  +  [ file where file.extension == "exe" ]
  +  [ process where true ]
  +----
  +
  +[discrete]
  +[[eql-syntax-optional-by-fields]]
  +==== Optional `by` fields
  +
  +By default, a join key must be a non-`null` field value. To allow `null` join
  +keys, use the `?` operator to mark the `by` field as
  +<<eql-syntax-optional-fields,optional>>. This is also helpful if you aren't sure
  +the dataset you're searching contains the `by` field.
  +
  +*Example* +
  +The following sequence query uses `sequence by` to constrain matching events
  +to:
  +
  +* Events with the same `process.pid` value, excluding `null` values. If the
  +  `process.pid` field doesn't exist in the dataset you're searching, the query
  +  returns an error.
  +
  +* Events with the same `process.entity_id` value, including `null` values. If
  +  an event doesn't contain the `process.entity_id` field, its
  +  `process.entity_id` value is considered `null`. This applies even if the
  +  `process.pid` field doesn't exist in the dataset you're searching.
  +
  +[source,eql]
  +----
  +sequence by process.pid, ?process.entity_id
  +  [process where process.name == "regsvr32.exe"]
  +  [network where true]
   ----
   
   [discrete]
  
positive.code: [[eql-by-keyword]]
  ==== `by` keyword
  
  You can use the `by` keyword with sequences to only match events that share the
  same field values. If a field value should be shared across all events, you
  can use `sequence by`.
  
  [source,eql]
  ----
  
negative.code: 
  [source,eql]
  ----
  ?my_field == null
  ----
  
  [discrete]
  [[eql-syntax-strings]]
  