anchor.diff:  
   By default, the EQL search API stores async searches for five days. After this
   period, any searches and their results are deleted. Use the `keep_alive`
  -parameter to change this retention period.
  -
  -In the following EQL search request, the `keep_alive` parameter is `2d` (two
  -days). If the search becomes async, its results
  -are stored on the cluster for two days. After two days, the async
  -search and its results are deleted, even if it's still ongoing.
  +parameter to change this retention period:
   
   [source,console]
   ----
  
positive.code: `keep_alive` parameter to later change the retention period. The new retention
  period starts after the get request runs.
  
  The following request sets the `keep_alive` query parameter to `5d` (five days).
  The async search and its results are deleted five days after the get request
  executes.
  
  [source,console]
  ----
  GET /_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?keep_alive=5d
  
negative.code: [[eql-search-async]]
  === Run an async EQL search
  
  By default, EQL search requests are synchronous and wait for complete results
  before returning a response. However, complete results can take longer for
  searches across <<frozen-indices,frozen indices>> or
  <<modules-cross-cluster-search,multiple clusters>>.
  
  To avoid long waits, run an async EQL search. Set the
  `wait_for_completion_timeout` parameter to a duration you'd like to wait for
  synchronous results.
  
  [source,console]
  ----
  