anchor.diff:  * Which client IPs have high error rates?
   
   * Which client IPs are interacting with a high number of destination countries?
  +
  +
  +[[example-last-log]]
  +== Finding the last log event for each IP address
  +
  +This example uses the web log sample data set to find the last log from an IP 
  +address. Let's use the `latest` type of {transform} in continuous mode. It 
  +copies the most recent document for each unique key from the source index to the destination index
  +and updates the destination index as new data comes into the source index. 
  +
  +Pick the `clientip` field as the unique key; the data is grouped by this field. 
  +Select `timestamp` as the date field that sorts the data chronologically. For 
  +continuous mode, specify a date field that is used to identify new documents, 
  +and an interval between checks for changes in the source index.
  +
  + Let's assume that we're interested in retaining documents only for IP addresses that appeared recently in the log. You can define a retention policy and specify a date field that is used to calculate 
  +the age of a document. This example uses the same date field that is used to 
  +sort the data. Then set the maximum age of a document; documents that are older 
  +than the value you set will be removed from the destination index.
  +
  +This {transform} creates the destination index that contains the latest login 
  +date for each client IP. As the {transform} runs in continuous mode, the 
  +destination index will be updated as new data that comes into the source index. 
  +Finally, every document that is older than 30 days will be removed from the 
  +destination index due to the applied retention policy.
  +
  +[source,console]
  +----------------------------------
  +PUT _transform/last-log-from-clientip
  +{
  +  "source": {
  +    "index": [
  +      "kibana_sample_data_logs"
  +    ]
  +  },
  +  "latest": {
  +    "unique_key": [ <1>
  +      "clientip"
  +    ],
  +    "sort": "timestamp" <2>
  +  },
  +  "frequency": "1m", <3>
  +  "dest": {
  +    "index": "last-log-from-clientip"
  +  },
  +  "sync": { <4>
  +    "time": {
  +      "field": "timestamp",
  +      "delay": "60s"
  +    }
  +  },
  +  "retention_policy": { <5>
  +    "time": {
  +      "field": "timestamp",
  +      "max_age": "30d"
  +    }
  +  },
  +  "settings": {
  +    "max_page_search_size": 500
  +  }
  +}
  +
  +----------------------------------
  +// TEST[skip:setup kibana sample data]
  +
  +<1> Specifies the field for grouping the data.
  +<2> Specifies the date field that is used for sorting the data.
  +<3> Sets the interval for the {transform} to check for changes in the source 
  +index.
  +<4> Contains the time field and delay settings used to synchronize the source 
  +and destination indices.
  +<5> Specifies the retention policy for the transform. Documents that are older 
  +than the configured value will be removed from the destination index. 
  +
  +
  +After you create the {transform}, start it:
  +
  +[source,console]
  +----------------------------------
  +POST _transform/last-log-from-clientip/_start
  +----------------------------------
  +// TEST[skip:setup kibana sample data]
  +
  +
  +After the {transform} processes the data, search the destination index:
  +
  +[source,console]
  +----------------------------------
  +GET last-log-from-clientip/_search
  +----------------------------------
  +// TEST[skip:setup kibana sample data]
  +
  +
  +The search result shows you data like this for each client IP:
  +
  +[source,js]
  +----------------------------------
  +{
  +  "_index" : "last-log-from-clientip",
  +  "_id" : "MOeHH_cUL5urmartKj-b5UQAAAAAAAAA",
  +  "_score" : 1.0,
  +  "_source" : {
  +    "referer" : "http://twitter.com/error/don-lind",
  +    "request" : "/elasticsearch",
  +    "agent" : "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)",
  +    "extension" : "",
  +    "memory" : null,
  +    "ip" : "0.72.176.46",
  +    "index" : "kibana_sample_data_logs",
  +    "message" : "0.72.176.46 - - [2018-09-18T06:31:00.572Z] \"GET /elasticsearch HTTP/1.1\" 200 7065 \"-\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)\"",
  +    "url" : "https://www.elastic.co/downloads/elasticsearch",
  +    "tags" : [
  +      "success",
  +      "info"
  +    ],
  +    "geo" : {
  +      "srcdest" : "IN:PH",
  +      "src" : "IN",
  +      "coordinates" : {
  +        "lon" : -124.1127917,
  +        "lat" : 40.80338889
  +      },
  +      "dest" : "PH"
  +    },
  +    "utc_time" : "2021-05-04T06:31:00.572Z",
  +    "bytes" : 7065,
  +    "machine" : {
  +      "os" : "ios",
  +      "ram" : 12884901888
  +    },
  +    "response" : 200,
  +    "clientip" : "0.72.176.46",
  +    "host" : "www.elastic.co",
  +    "event" : {
  +      "dataset" : "sample_web_logs"
  +    },
  +    "phpmemory" : null,
  +    "timestamp" : "2021-05-04T06:31:00.572Z"
  +  }
  +}
  +----------------------------------
  +// NOTCONSOLE
  +
  +This {transform} makes it easier to answer questions such as:
  +
  +* What was the most recent log event associated with a specific IP address?
  
positive.code: ----------------------------------
  // TEST[skip:setup kibana sample data]
  
  <1> This is the destination index for the {transform}. It is ignored by
  `_preview`.
  <2> Two `group_by` fields have been selected. This means the {transform} will
  contain a unique row per `user` and `customer_id` combination. Within this
  dataset both these fields are unique. By including both in the {transform} it
  gives more context to the final results.
  
  NOTE: In the example above, condensed JSON formatting has been used for easier 
  readability of the pivot object.
  
  The preview {transforms} API enables you to see the layout of the
  {transform} in advance, populated with some sample values. For example:
  
  [source,js]
  ----------------------------------
  
negative.code: ----------------------------------
  // NOTCONSOLE
  
  
  This {transform} makes it easier to answer questions such as:
  
  * Which customers spend the most?
  