anchor.diff:  Common Schema (ECS)]. If an index does not contain the `event.category` field,
   this value is required.
   
  -[[eql-search-api-timestamp-field]]
  -`timestamp_field`::
  -+
  ---
  -(Required*, string)
  -Field containing event timestamp.
  -
  -Defaults to `@timestamp`, as defined in the
  -{ecs-ref}/ecs-event.html[Elastic Common Schema (ECS)]. If an index does not
  -contain the `@timestamp` field, this value is required.
  -
  -Events in the API response are sorted by this field's value, converted to
  -milliseconds since the https://en.wikipedia.org/wiki/Unix_time[Unix epoch], in
  -ascending order.
  ---
  -
  -`implicit_join_key_field`::
  -(Optional, string)
  -Reserved for future use.
  -
   `filter`::
   (Optional, <<query-dsl,query DSL object>>)
   Query, written in query DSL, used to filter the events on which the EQL query
   runs.
   
  +`implicit_join_key_field`::
  +(Optional, string)
  +Reserved for future use.
  +
  +`query`::
  +(Required, string)
  +<<eql-syntax,EQL>> query you wish to run.
  ++
  +IMPORTANT: This parameter supports a subset of EQL syntax. See
  +<<eql-unsupported-syntax>>.
  +
   `search_after`::
   (Optional, string)
   Reserved for future use.
  
positive.code: (Optional, integer or float)
  Maximum number of matching events to return. Defaults to `50`. Values must be
  greater than `0`.
  
  [role="child_attributes"]
  [[eql-search-api-response-body]]
  
negative.code: [[eql-search-api-request-body]]
  ==== {api-request-body-title}
  
  `event_category_field`::
  (Required*, string)
  Field containing the event classification, such as `process`, `file`, or
  