anchor.diff:      "detectors":[
         {
           "function":"mean",
  -        "field_name": "total_error_count", <1>
  -        "detector_description": "Custom script field transformation"
  +        "field_name": "total_error_count" <1>
         }
       ]
     },
     "data_description": {
  -  "time_field":"@timestamp",
  -  "time_format":"epoch_ms"
  +    "time_field":"@timestamp"
     }
   }
   
  
positive.code: [role="screenshot"]
  image::images/ml-runtimefields.jpg[Using runtime_mappings in {dfeed} config via {kib}]
  
  
  [[ml-configuring-transform-examples]]
  == Common runtime field examples
  
  While the possibilities are limitless, there are a number of common scenarios
  where you might use runtime fields in your {dfeeds}.
  
  [NOTE]
  ===============================
  Some of these examples use regular expressions. By default, regular
  expressions are disabled because they circumvent the protection that Painless
  provides against long running and memory hungry scripts. For more information,
  see {ref}/modules-scripting-painless.html[Painless scripting language].
  
  {ml-cap} analysis is case sensitive. For example, "John" is considered to be 
  different than "john". This is one reason you might consider using scripts that 
  convert your strings to upper or lowercase letters.
  ===============================
  
  [[ml-configuring-transform2]]
  .Example 2: Concatenating strings
  
negative.code:   }
  }
  
  GET _ml/datafeeds/datafeed-test4/_preview
  --------------------------------------------------
  // TEST[skip:needs-licence]
  
  