anchor.diff:  `keep_alive` parameter to later change the retention period. The new retention
   period starts after the get request runs.
   
  -The following request sets the `keep_alive` query parameter to `5d` (five days).
  -The async search and its results are deleted five days after the get request
  -executes.
  -
   [source,console]
   ----
   GET /_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?keep_alive=5d
  
positive.code: // TESTRESPONSE[s/"took": 52/"took": $body.took/]
  // TESTRESPONSE[s/"hits": \.\.\./"hits": $body.hits/]
  
  Use the search ID and the <<get-async-eql-search-api,get async EQL search API>>
  to retrieve the same results later.
  
  [source,console]
  ----
  
negative.code: ----
  // TEST[skip: no access to search ID]
  
  If the response's `is_running` value is `false`, the async search has finished.
  If the `is_partial` value is `false`, the returned search results are
  complete.
  
  [source,console-result]
  ----
  