anchor.diff:  TIP: If your detectors use metric or sum analytical functions, set the
   `interval` of the date histogram aggregation to a tenth of the `bucket_span`
   that was defined in the job. This suggestion creates finer, more granular time
  -buckets, which are ideal for this type of analysis. If your detectors use count or rare functions, set
  -`interval` to the same value as `bucket_span`. For more information about
  -analytical functions, see <<ml-functions>>.
  -
  -//TBD: Add more examples from https://github.com/elastic/prelert-legacy/wiki/Configuring-aggregations-on-a-datafeed
  +buckets, which are ideal for this type of analysis. If your detectors use count
  +or rare functions, set `interval` to the same value as `bucket_span`. For more
  +information about analytical functions, see <<ml-functions>>.
  
positive.code: `airline` and `responsetime`. Since you must create the job before you can
  create the {dfeed}, synchronizing your aggregation and field names can simplify
  these configuration steps.
  //TBD: Describe how this would be accomplished in Kibana?
  
  When you define an aggregation in a {dfeed}, it must have the following form:
  
  
negative.code: distributes these calculations across your cluster. You can then feed this
  aggregated data into {xpackml} instead of raw results, which
  reduces the volume of data that must be considered while detecting anomalies.
  
  There are some limitations to using aggregations in {dfeeds}, however.
  Your aggregation must include a buckets aggregation, which in turn must contain
  