anchor.diff:  The top level aggregation must be either a
   {ref}/search-aggregations-bucket.html[bucket aggregation] containing as single
   sub-aggregation that is a `date_histogram` or the top level aggregation is the
  -required `date_histogram`. There must be exactly 1 `date_histogram` aggregation.
  -For more information, see
  +required `date_histogram`. There must be exactly one `date_histogram`
  +aggregation. For more information, see
   {ref}/search-aggregations-bucket-datehistogram-aggregation.html[Date histogram aggregation].
   
   NOTE: The `time_zone` parameter in the date histogram aggregation must be set to
  
positive.code:         "time_zone": "UTC"
        },
        "aggregations": {
          "time": {
            "max": {"field": "time"}
          },
          "airline": {
            "terms": {
              "field": "airline",
              "size": 100
            },
            "aggregations": {
              "responsetime": {
                "avg": {
                  "field": "responsetime"
                }
  
negative.code:     "bucket_span": "60m",
      "detectors": [{
        "function": "mean",
        "field_name": "responsetime",  <1>
        "by_field_name": "airline"  <1>
      }],
      "summary_count_field_name": "doc_count"
    },
    "data_description": {
      "time_field":"time"  <1>
    }
  }
  ----------------------------------
  // TEST[skip:setup:farequote_data]
  
  <1> In this example, the `airline`, `responsetime`, and `time` fields are
  aggregations. Only the aggregated fields defined in the `analysis_config` object 
  are analyzed by the {anomaly-job}.
  
  NOTE: When the `summary_count_field_name` property is set to a non-null value,
  the job expects to receive aggregated input. The property must be set to the
  