anchor.diff:      "search": {
         "request": {
           "indices": [
  -          "<logstash-{now-1h}>",
  -          "<logstash-{now}>"
  +          "logstash"
           ],
           "body": {
             "size": 0,
  
positive.code:           "aggs": {
              "group_by_city": {
                "terms": {
                  "field": "group.group_city.raw",
                  "size": 5
                },
                "aggs": {
                  "group_by_event": {
                    "terms": {
                      "field": "event.event_url.raw",
                      "size": 5
                    },
                    "aggs": {
  
negative.code:   },
    "condition": {
      "compare": {
        "ctx.payload.hits.total": {
          "gt": 0
        }
      }
  