anchor.diff:  
   [discrete]
   [[eql-until-keyword]]
  -=== `until` keyword
  +==== `until` keyword
   
   You can use the `until` keyword to specify an expiration event for a sequence.
   If this expiration event occurs _between_ matching events in a sequence, the
  
positive.code: 
  [discrete]
  [[eql-syntax-wildcards]]
  === Wildcards
  
  For string comparisons using the `:` operator or `like` keyword, you can use the
  `*` and `?` wildcards to match specific patterns. The `*` wildcard matches zero
  
negative.code: 
  [discrete]
  [[eql-syntax-check-field-exists]]
  ==== Check if a field exists
  
  To match events containing any value for a field, compare the field to `null`
  using the `!=` operator:
  